PT-2005-3452 · Myfaq · Myfaq

Publicado 2005-08-16 · Atualizado 2016-10-18 · CVE-2005-2561

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MYFAQ version 1.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several API endpoints, including 'affichagefaq.php3', 'choixsoustheme.php3', 'consultation.php3', 'insfaq.php3', 'inssoustheme.php3', 'instheme.php3', 'saisiefaqtotale.php3', 'saisiesoustheme.php3', and 'voirfaq.php3'. Vulnerable parameters include the Theme parameter, the SousTheme parameter, the Faq parameter, and the question parameter.

Recommendations For MYFAQ version 1.0, as a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is available. Avoid using the Theme, SousTheme, Faq, and question parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-2561

Produtos afetados

Myfaq

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-2561 · Nota de Segurança
• http://securityfocus.com/bid/14503 · Nota
• http://secunia.com/advisories/16366 · Nota
• http://marc.info/?l=bugtraq&m=112352204602309&w=2 · Nota
• http://svt.nukleon.us/lab/svadvisory13.txt · Nota