PT-2005-1661 · Postnuke · Postnuke

Cxib8O3 + 1 · Publicado 2005-03-02 · Atualizado 2016-10-18 · CVE-2005-0615

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostNuke versions 0.760-RC2

Description The issue concerns SQL injection vulnerabilities in certain PHP files, specifically index.php, modules.php, and admin.php. These vulnerabilities allow remote attackers to execute arbitrary SQL code by manipulating the catid parameter.

Recommendations For PostNuke version 0.760-RC2, avoid using the catid parameter in the affected API endpoints until the issue is resolved. Consider restricting access to the vulnerable PHP files, such as index.php, modules.php, and admin.php, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-0615

Produtos afetados

Postnuke

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-0615 · Nota de Segurança
• http://securitytracker.com/id?1013324 · Correção
• http://news.postnuke.com/Article2669.html · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=110962819232255&w=2 · Nota