PT-2004-3329 · Php Fusion · Php-Fusion

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2437

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHP-Fusion version 4.01

Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the rowstart parameter to index.php or members.php, or the comment id parameter to comments.php.

Recommendations: For PHP-Fusion version 4.01, consider restricting access to the vulnerable parameters rowstart and comment id until a patch is available. As a temporary workaround, avoid using the rowstart parameter in index.php and members.php, and the comment id parameter in comments.php to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2004-2437

Produtos afetados

Php-Fusion

Referências · 7

• http://osvdb.org/10438 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2437 · Nota
• http://secunia.com/advisories/12686 · Aviso do Fabricante
• http://securityfocus.com/bid/11296 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2437 · Nota de Segurança
• http://osvdb.org/10437 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17546 · Nota