PT-2005-4692 · Php · Php Labs Top Auction

Ajann · Publicado 2005-12-01 · Atualizado 2018-10-19 · CVE-2005-3952

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP Labs Top Auction version 1.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the category and type parameters to "viewcat.php", or certain search parameters.

Recommendations For version 1.0, consider restricting access to the vulnerable parameters category and type in the "viewcat.php" endpoint until a patch is available. Avoid using certain search parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2005-3952

Produtos afetados

Php Labs Top Auction

Referências · 10

• 🔥 https://exploit-db.com/exploits/3456 · Exploit
• http://osvdb.org/21106 · Nota
• http://securityfocus.com/archive/1/466569/100/200/threaded · Nota
• http://pridels0.blogspot.com/2005/11/top-auction-multiple-sql-vuln.html · Nota
• http://osvdb.org/21105 · Nota
• http://vupen.com/english/advisories/2005/2552 · Aviso do Fabricante
• http://secunia.com/advisories/17687 · Aviso do Fabricante
• http://securityfocus.com/bid/15547 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3952 · Nota de Segurança
• http://securityfocus.com/archive/1/466565/100/200/threaded · Nota