PT-2004-3097 · Duclassified · Duclassified

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2202

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DUclassified versions 4.0 through 4.2

Description The issue allows remote attackers to bypass authentication and execute commands on the server's underlying database. This can be achieved via the cat id or sub id parameters in "adDetail.asp", or the password parameter in the login form.

Recommendations For versions 4.0 through 4.2, consider restricting access to the adDetail.asp page and the login form until a patch is available. As a temporary workaround, avoid using the cat id, sub id, and password parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2004-2202

Produtos afetados

Duclassified

Referências · 8

• 🔥 http://osvdb.org/10669 · Exploit
• 🔥 http://securitytracker.com/alerts/2004/Oct/1011596.html · Exploit
• 🔥 http://securityfocus.com/bid/11363 · Exploit
• 🔥 http://osvdb.org/10668 · Exploit
• 🔥 https://exploit-db.com/exploits/24671 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2202 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2202 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17685 · Nota