PT-2005-3297 · Php · Phpnews

Rst · Publicado 2005-07-26 · Atualizado 2016-10-18 · CVE-2005-2383

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPNews version 1.2.5

Description The issue allows remote attackers to execute arbitrary SQL commands via the user parameter in an HTTP POST request. This is a SQL injection vulnerability in the auth.php file.

Recommendations For PHPNews version 1.2.5, consider restricting access to the auth.php file or validating and sanitizing the user parameter to prevent SQL injection attacks. As a temporary workaround, avoid using the user parameter in the affected HTTP POST request until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2005-2383

Produtos afetados

Phpnews

Referências · 6

• 🔥 https://exploit-db.com/exploits/26016 · Exploit
• http://newsphp.sourceforge.net/changelog/changelog_1.30.txt · Correção
• http://securityfocus.com/bid/14333 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2383 · Nota de Segurança
• http://secunia.com/advisories/16148 · Nota
• http://marc.info/?l=bugtraq&m=112189453304389&w=2 · Nota