PT-2005-2610 · Jgs Xa · Jgs-Portal

Deluxe89 · Publicado 2005-05-17 · Atualizado 2016-10-18 · CVE-2005-1633

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JGS-XA JGS-Portal versions 3.0.2 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including anzahl beitraege to "jgs portal.php", year to "jgs portal statistik.php", "jgs portal beitraggraf.php", "jgs portal themengraf.php", and "jgs portal mitgraf.php", tag to "jgs portal viewsgraf.php", id to "jgs portal sponsor.php", or the Accept-Language header to "jgs portal log.php".

Recommendations For JGS-XA JGS-Portal versions 3.0.2 and earlier, consider disabling the affected parameters, such as anzahl beitraege, year, tag, and id, until a patch is available. Additionally, restrict access to the Accept-Language header in "jgs portal log.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Identificadores relacionados

CVE-2005-1633

Produtos afetados

Jgs-Portal

Referências · 10

• 🔥 https://exploit-db.com/exploits/25678 · Exploit
• 🔥 https://exploit-db.com/exploits/25676 · Exploit
• 🔥 https://exploit-db.com/exploits/25677 · Exploit
• 🔥 https://exploit-db.com/exploits/25673 · Exploit
• 🔥 https://exploit-db.com/exploits/25675 · Exploit
• 🔥 https://exploit-db.com/exploits/25679 · Exploit
• 🔥 https://exploit-db.com/exploits/25674 · Exploit
• http://marc.info/?l=bugtraq&m=111627681218415&w=2 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1633 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1633 · Nota de Segurança