PT-2005-4683 · Ilyav · Ilyav Faq System

Publicado 2005-12-01 · Atualizado 2011-03-08 · CVE-2005-3943

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ilyav FAQ System versions 1.1 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the FAQ ID and action parameters in "viewFAQ.php", and the CATEGORY ID parameter in "index.php".

Recommendations For ilyav FAQ System versions 1.1 and earlier, consider restricting access to the vulnerable parameters FAQ ID, action, and CATEGORY ID in the affected files "viewFAQ.php" and "index.php" until a patch is available. Avoid using these parameters in the respective API endpoints to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-3943

Produtos afetados

Ilyav Faq System

Referências · 8

• 🔥 https://exploit-db.com/exploits/26660 · Exploit
• 🔥 http://osvdb.org/21202 · Exploit
• 🔥 http://securityfocus.com/bid/15640 · Exploit
• 🔥 https://exploit-db.com/exploits/26659 · Exploit
• http://vupen.com/english/advisories/2005/2653 · Nota
• http://pridels0.blogspot.com/2005/11/faq-system-11-sql-inj-vuln.html · Nota
• http://secunia.com/advisories/17801 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-3943 · Nota de Segurança