PT-2005-2987 · Unknown · Duportal Pro

Dedi Dwianto · Publicado 2005-06-22 · Atualizado 2016-10-18 · CVE-2005-2045

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DUportal PRO version 3.4.3

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including the iChannel parameter to "default.asp", the iData parameter to "detail.asp", the iMem parameter to "members.asp", the iCat parameter to "cat.asp", the offset parameter to "members listing approval.asp", or the iChannel parameter to "channels edit.asp".

Recommendations For DUportal PRO version 3.4.3, as a temporary workaround, consider restricting access to the affected API endpoints, such as "default.asp", "detail.asp", "members.asp", "cat.asp", "members listing approval.asp", and "channels edit.asp", until a patch is available. Avoid using the parameters iChannel, iData, iMem, iCat, and offset in the respective affected endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-2045

Produtos afetados

Duportal Pro

Referências · 6

• 🔥 http://echo.or.id/adv/adv19-theday-2005.txt · Exploit
• http://marc.info/?l=bugtraq&m=111945219205114&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2045 · Nota de Segurança
• http://osvdb.org/17599 · Nota
• http://osvdb.org/17598 · Nota
• http://osvdb.org/17597 · Nota