PT-2005-4770 · Web4Future · Web4Future Edating Professional

Publicado 2005-12-06 · Atualizado 2011-03-08 · CVE-2005-4034

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Web4Future eDating Professional version 5

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in several parameters, including s, pg, and sortb in "index.php", cid in "gift.php" and "fq.php", and cat in "articles.php".

Recommendations For Web4Future eDating Professional version 5, consider restricting access to the vulnerable parameters s, pg, sortb, cid, and cat in the respective files until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoints.

Exploit

Correção

Identificadores relacionados

CVE-2005-4034

Produtos afetados

Web4Future Edating Professional

Referências · 13

• 🔥 http://osvdb.org/21420 · Exploit
• 🔥 http://securityfocus.com/bid/15715 · Exploit
• 🔥 http://osvdb.org/21421 · Exploit
• 🔥 http://osvdb.org/21419 · Exploit
• 🔥 https://exploit-db.com/exploits/26727 · Exploit
• 🔥 http://osvdb.org/21418 · Exploit
• 🔥 https://exploit-db.com/exploits/26724 · Exploit
• 🔥 https://exploit-db.com/exploits/26725 · Exploit
• 🔥 https://exploit-db.com/exploits/26726 · Exploit
• http://secunia.com/advisories/17879 · Aviso do Fabricante
• http://pridels0.blogspot.com/2005/12/web4future-edating-professional-v5-sql.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4034 · Nota de Segurança
• http://vupen.com/english/advisories/2005/2734 · Nota