PT-2005-4714 · Du · Dupaypal+7

Publicado 2005-12-03 · Atualizado 2017-07-20 · CVE-2005-3976

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DUamazon version 3.1 DUarticle version 1.1 DUclassified version 4.2 DUdirectory versions 3.0 through 3.1 DUdownload version 1.1 DUgallery version 3.3 DUnews version 1.1 DUpaypal versions 3.0 through 3.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the iType parameter in the type.asp file.

Recommendations For DUamazon version 3.1, avoid using the iType parameter in the type.asp file until the issue is resolved. For DUarticle version 1.1, restrict access to the type.asp file to minimize the risk of exploitation. For DUclassified version 4.2, consider disabling the type.asp file until a patch is available. For DUdirectory versions 3.0 through 3.1, restrict the use of the iType parameter in the type.asp file. For DUdownload version 1.1, avoid using the type.asp file until the issue is resolved. For DUgallery version 3.3, consider temporarily removing the type.asp file. For DUnews version 1.1, restrict access to the type.asp file. For DUpaypal versions 3.0 through 3.1, avoid using the iType parameter in the type.asp file until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-3976

Produtos afetados

Duamazon

Duarticle

Duclassified

Dudirectory

Dudownload

Dugallery

Dunews

Dupaypal

Referências · 7

• http://vupen.com/english/advisories/2005/2700 · Nota
• http://secunia.com/advisories/17835 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30673 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3976 · Nota
• http://securityfocus.com/bid/15681 · Nota
• http://osvdb.org/21385 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3976 · Nota de Segurança