PT-2005-4498 · Phpcomasy · Phpcomasy

Publicado 2005-11-22 · Atualizado 2011-08-05 · CVE-2005-3744

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpComasy versions 0.7.5 and earlier

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. The issue is related to the id parameter. However, an examination of the source code suggests that the id parameter is not directly handled by index.php.

Recommendations For phpComasy versions 0.7.5 and earlier, consider restricting access to the index.php file until a fix is available. Avoid using the id parameter in the affected API endpoint until the issue is resolved.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2005-3744

Produtos afetados

Phpcomasy

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-3744 · Nota de Segurança
• http://osvdb.org/20984 · Nota
• http://pridels0.blogspot.com/2005/11/phpcomasy-id-sql-injection.html · Nota
• http://vupen.com/english/advisories/2005/2507 · Aviso do Fabricante
• http://securityfocus.com/bid/15511 · Nota
• http://secunia.com/advisories/17660 · Aviso do Fabricante