PT-2004-3452 · Wecenter · Webcenter

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2561

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Web+Center version 4.0.1

Description The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved via the ISS TECH CENTER LOGIN cookie in the "search.asp" endpoint and one or more cookies in the "DoCustomerOptions.asp" endpoint. The estimated number of potentially affected devices and details about real-world incidents are not specified.

Recommendations For Web+Center version 4.0.1, consider restricting access to the search.asp and DoCustomerOptions.asp endpoints until a fix is available. As a temporary workaround, avoid using the ISS TECH CENTER LOGIN cookie in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2004-2561

Produtos afetados

Webcenter

Referências · 7

• 🔥 http://osvdb.org/8180 · Exploit
• 🔥 http://securiteam.com/windowsntfocus/5RP0N0ADGK.html · Exploit
• 🔥 http://securityfocus.com/bid/10771 · Exploit
• 🔥 https://exploit-db.com/exploits/24298 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2561 · Nota de Segurança
• http://secunia.com/advisories/12121 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16775 · Nota