PT-2005-2899 · Invision · Invision Gallery

James Bercegay · Publicado 2005-06-09 · Atualizado 2016-10-18 · CVE-2005-1948

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Invision Gallery versions prior to 1.3.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the comment parameter in an editcomment action or the rating parameter when voting on a photo.

Recommendations For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the editcomment action and photo voting functionality to minimize the risk of exploitation. Avoid using the comment and rating parameters in the affected actions until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-1948

Produtos afetados

Invision Gallery

Referências · 5

• 🔥 http://gulftech.org/?node=research&article_id=00079-06092005 · Exploit
• 🔥 https://exploit-db.com/exploits/25806 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1948 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=111834146710329&w=2 · Nota
• http://securityfocus.com/bid/13907 · Nota