Pinnacle ShowCenter 1.51 - Web Interface Skin Denial of Service

Author: Marc Ruef
type: dos
platform: php
port: 
date_added: 2004-09-21 
date_updated: 2013-03-06 
verified: 1 
codes: CVE-2004-1699;OSVDB-10227 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/11232/info

The Pinnacle Systems ShowCenter web-based interface is reported prone to a remote denial of service vulnerability.

The issue exists due to a lack of sanity checks performed on the Skin parameter of a ShowCenter script.

It is reported that the affect of this attack will be persistent, any request for the ShowCenter web-based interface received subsequent to an attack will result in 'File or Folder not found' error message, as the interface fails to render.

A remote attacker may exploit this condition to persistently deny service to the ShowCenter web-based interface.

http://www.example.com:8000/ShowCenter/SettingsBase.php?Skin=ATK