PT-2004-3606 · Php · Phpmychat

Publicado 2004-12-31 · Atualizado 2017-07-29 · CVE-2004-2716

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPMyChat version 0.14.5

Description The issue concerns SQL injection vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. The vulnerable parameters are sortBy, sortOrder, startReg, U, LastCheck, and R.

Recommendations For PHPMyChat version 0.14.5, consider restricting access to the usersL.php3 file until a patch is available. As a temporary workaround, avoid using the parameters sortBy, sortOrder, startReg, U, LastCheck, and R in the affected API endpoint. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2004-2716

Produtos afetados

Phpmychat

Referências · 8

• 🔥 http://securityfocus.com/bid/10556 · Exploit
• 🔥 https://exploit-db.com/exploits/24215 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2004-06/0252.html · Exploit
• http://osvdb.org/7152 · Nota
• http://secunia.com/advisories/11894 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16442 · Nota
• http://securitytracker.com/id?1010515 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2716 · Nota de Segurança