PT-2003-1929 · Deskpro · Deskpro

Aviram Jenik · Publicado 2003-10-25 · Atualizado 2017-07-11 · CVE-2003-0874

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions DeskPRO versions 1.1.0 and earlier

Description The issue allows remote attackers to insert arbitrary SQL and conduct unauthorized activities. This can be achieved via several parameters: the cat parameter in "faq.php", the article parameter in "faq.php", the tickedid parameter in "view.php", and the Password entry on the logon screen.

Recommendations For DeskPRO versions 1.1.0 and earlier, as a temporary workaround, consider restricting access to the "faq.php" and "view.php" files until a patch is available. Avoid using the cat, article, and tickedid parameters in their respective files, and restrict the Password entry on the logon screen to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2003-0874

Produtos afetados

Deskpro

Referências · 7

• 🔥 http://securiteam.com/unixfocus/6R0052K8KM.html · Exploit
• 🔥 http://securityfocus.com/bid/8856 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0874 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-0874 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13391 · Nota
• http://archives.neohapsis.com/archives/vulnwatch/2003-q4/0017.html · Nota
• http://marc.info/?l=bugtraq&m=106667525623311&w=2 · Nota