PT-2002-3103 · Xoops+1 · Xoops+1

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-2391

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebChat version 1.5 XOOPS version 1.0

Description The issue allows remote attackers to execute arbitrary SQL commands via the roomid parameter in the "index.php" file of WebChat.

Recommendations For WebChat version 1.5, avoid using the roomid parameter in the affected API endpoint until the issue is resolved. For XOOPS version 1.0, restrict access to the vulnerable WebChat module to minimize the risk of exploitation.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2002-2391

Produtos afetados

Wechat

Xoops

Referências · 6

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-11/0136.html · Exploit
• http://iss.net/security_center/static/10606.php · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2391 · Nota
• http://cert.uni-stuttgart.de/archive/bugtraq/2002/11/msg00258.html · Nota
• http://securityfocus.com/bid/6165 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-2391 · Nota de Segurança