PT-2005-1869 · Phpmyfamily · Phpmyfamily

Kre0N · Publicado 2005-03-24 · Atualizado 2017-07-11 · CVE-2005-0841

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyFamily version 1.4.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved through the person parameter to the "people.php" endpoint or the Login field.

Recommendations For phpMyFamily version 1.4.0, consider restricting access to the affected php files, such as people.php, track.php, edit.php, document.php, census.php, and passthru.php, until a patch is available. As a temporary workaround, avoid using the person parameter in the "people.php" endpoint and restrict the use of the Login field in the affected scripts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2005-0841

Produtos afetados

Phpmyfamily

Referências · 7

• 🔥 http://securitytracker.com/id?1013493 · Exploit
• 🔥 http://securityfocus.com/bid/12860 · Exploit
• 🔥 https://exploit-db.com/exploits/892 · Exploit
• http://secunia.com/advisories/14642 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-0841 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=111143649730845&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19787 · Nota