PT-2005-3150 · Dragonfly · Dragonfly Commerce

Diabolic Crab · Publicado 2005-07-12 · Atualizado 2024-08-07 · CVE-2005-2221

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Dragonfly Commerce versions (affected versions not specified)

Description: The issue allows remote attackers to modify SQL statements and possibly execute arbitrary SQL commands via several parameters, including the key parameter to "dc Categoriesview.asp", the PID parameter to "ratings.asp", the start, key mp, searchtype, or psearch parameters to "dc forum Postslist.asp". The vendor has disputed this issue, stating that the error messages arise from invalid category and product numbers. However, the issue still satisfies the definition of exposure.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-2221

Produtos afetados

Dragonfly Commerce

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-2221 · Nota de Segurança
• http://digitalparadox.org/viewadvisories.ah?view=46 · Nota
• http://marc.info/?l=bugtraq&m=112121930328341&w=2 · Nota
• https://t.me/cvenotify/89838 · Publicação no Telegram