PT-2005-3606 · Pafiledb · Pafiledb

Deluxe89 · Publicado 2005-08-29 · Atualizado 2017-07-11 · CVE-2005-2723

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PaFileDB version 3.1

Description A SQL injection issue exists in the auth.php file of PaFileDB when the authmethod is set to cookies. This allows remote attackers to execute arbitrary SQL commands by manipulating the username value in the pafiledbcookie cookie.

Recommendations For PaFileDB version 3.1, update the auth.php file to properly sanitize the username value in the pafiledbcookie cookie to prevent SQL injection attacks. As a temporary workaround, consider restricting access to the auth.php file or disabling the use of cookies as an authmethod until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2005-2723

Produtos afetados

Pafiledb

Referências · 6

• 🔥 http://securityfocus.com/bid/14654 · Exploit
• http://security-project.org/projects/board/showthread.php?t=947 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-2723 · Nota de Segurança
• http://secunia.com/advisories/16566 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21988 · Nota
• http://marc.info/?l=bugtraq&m=112490781927680&w=2 · Nota