PT-2004-3458 · Recipants · Recipants

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2567

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ReciPants version 1.1.1

Description The issue allows remote attackers to execute arbitrary SQL commands via several ID number fields, including the user id, recipe id, category id, and other ID fields. This can potentially lead to unauthorized access and manipulation of data.

Recommendations For ReciPants version 1.1.1, consider restricting access to the SQL database and validating user input to prevent SQL injection attacks. As a temporary workaround, restrict the use of the ID number fields until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2004-2567

Produtos afetados

Recipants

Referências · 6

• http://sourceforge.net/project/shownotes.php?group_id=90737&release_id=234415 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16024 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2567 · Nota de Segurança
• http://secunia.com/advisories/11533 · Aviso do Fabricante
• http://securitytracker.com/id?1009984 · Correção
• http://securityfocus.com/bid/10250 · Correção