PT-2002-1889 · Logisense · Hawk-I Billing+3

Publicado 2002-08-31 · Atualizado 2008-09-05 · CVE-2002-0878

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: LogiSense software including Hawk-i Billing versions (affected versions not specified) Hawk-i ASP versions (affected versions not specified) DNS Manager versions (affected versions not specified)

Description: The issue allows remote attackers to bypass authentication via SQL code in the password field in the login form.

Recommendations: For Hawk-i Billing, update to a version that fixes the SQL injection issue in the login form. For Hawk-i ASP, update to a version that fixes the SQL injection issue in the login form. For DNS Manager, update to a version that fixes the SQL injection issue in the login form. As a temporary workaround, consider restricting access to the login form to minimize the risk of exploitation. Avoid using SQL code in the password field in the affected login form until the issue is resolved.

Correção

Identificadores relacionados

CVE-2002-0878

Produtos afetados

Dns Manager

Hawk-I Asp

Hawk-I Billing

Logisense

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-0878 · Nota de Segurança
• http://securityfocus.com/bid/4931 · Aviso do Fabricante
• http://archives.neohapsis.com/archives/bugtraq/2002-06/0010.html · Nota
• http://iss.net/security_center/static/9268.php · Aviso do Fabricante