PT-2005-1971 · Phpcoin · Phpcoin

James Bercegay · Publicado 2005-03-29 · Atualizado 2016-10-18 · CVE-2005-0946

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpCoin versions 1.2.1b and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several fields, including the term/keywords field on the search page, the username or e-mail field on the forgot password page, or the domain name on the ordering new package page.

Recommendations For phpCoin versions 1.2.1b and earlier, consider restricting access to the search page, forgot password page, and ordering new package page until a fix is available. As a temporary workaround, avoid using the term/keywords, username, e-mail, and domain name fields in the respective pages.

Correção

Identificadores relacionados

CVE-2005-0946

Produtos afetados

Phpcoin

Referências · 4

• http://gulftech.org/?node=research&article_id=00065-03292005 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0946 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=111214190111520&w=2 · Nota
• http://securityfocus.com/bid/12917 · Correção