PT-2005-3188 · Usanet Creations · Makebid Reverse Auction+3

Publicado 2005-07-13 · Atualizado 2008-09-05 · CVE-2005-2259

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: USANet Shopping Mall Software (affected versions not specified) Domain Name Auction Software (affected versions not specified) Standard Classified Ads Software (affected versions not specified) MakeBid Reverse Auction (affected versions not specified)

Description: The issue allows remote attackers to execute arbitrary code via shell metacharacters in the DISPCLOSED parameter, specifically in the dispallclosed2 function. This function is part of the dispallclosed.pl script used in multiple USANet Creations products.

Recommendations: For USANet Shopping Mall Software, restrict access to the dispallclosed2 function until a patch is available. For Domain Name Auction Software, avoid using the DISPCLOSED parameter in the affected API endpoint until the issue is resolved. For Standard Classified Ads Software, consider disabling the dispallclosed2 function as a temporary workaround. For MakeBid Reverse Auction, restrict the use of shell metacharacters in the DISPCLOSED parameter to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-2259

Produtos afetados

Domain Name Auction

Makebid Reverse Auction

Standard Classified Ads

Usanet Shopping Mall

Referências · 4

• http://secunia.com/advisories/15985 · Nota
• http://securitytracker.com/id?1014411 · Aviso do Fabricante
• http://securityfocus.com/bid/14179 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2259 · Nota de Segurança