PT-2005-4842 · Lyris · Lyris Listmanager

Publicado 2005-12-10 · Atualizado 2018-10-19 · CVE-2005-4143

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Lyris ListManager versions 5.0 through 8.9a

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by injecting SQL code after a numeric argument to a "/read/attachment" API endpoint.

Recommendations For versions 5.0 through 8.9a, consider restricting access to the "/read/attachment" API endpoint until a patch is available. As a temporary workaround, avoid using numeric arguments in the "/read/attachment" URL to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-4143

Produtos afetados

Lyris Listmanager

Referências · 10

• 🔥 http://metasploit.com/research/vulns/lyris_listmanager · Exploit
• 🔥 https://exploit-db.com/exploits/1366 · Exploit
• 🔥 http://osvdb.org/21548 · Exploit
• 🔥 http://securityfocus.com/bid/15787 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4143 · Nota de Segurança
• http://vupen.com/english/advisories/2005/2820 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4143 · Nota
• http://secunia.com/advisories/17943 · Aviso do Fabricante
• http://securityfocus.com/archive/1/419077/100/0/threaded · Nota