PT-2005-4619 · Unknown · Enterprise Connector

Publicado 2005-11-29 · Atualizado 2011-03-08 · CVE-2005-3875

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Enterprise Connector versions 1.0.2 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the messageid parameter in either the "send.php" or a delete action in "messages.php" API endpoints.

Recommendations For Enterprise Connector versions 1.0.2 and earlier, consider restricting access to the send.php and messages.php endpoints until a patch is available. As a temporary workaround, avoid using the messageid parameter in these endpoints to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-3875

Produtos afetados

Enterprise Connector

Referências · 9

• 🔥 https://exploit-db.com/exploits/26603 · Exploit
• 🔥 https://exploit-db.com/exploits/26602 · Exploit
• http://vupen.com/english/advisories/2005/2602 · Nota
• http://securityfocus.com/bid/15578 · Nota
• http://pridels0.blogspot.com/2005/11/enterprise-connector-sql-inj-vuln.html · Nota
• http://secunia.com/advisories/17743 · Aviso do Fabricante
• http://osvdb.org/21142 · Nota
• http://osvdb.org/21141 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3875 · Nota de Segurança