PT-2005-4912 · E107 · E107

Publicado 2005-12-14 · Atualizado 2018-10-19 · CVE-2005-4224

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions e107 version 0.7

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible via several parameters in different PHP files, including email, hideemail, image, realname, signature, timezone, and xupexist in "signup.php", content comment, content rating, and content summary in "subcontent.php", download category and file demo in "upload.php", and email, hideemail, user timezone, and user xup in "usersettings.php".

Recommendations For e107 version 0.7, as a temporary workaround, consider restricting access to the vulnerable parameters until a patch is available. Avoid using the parameters email, hideemail, image, realname, signature, timezone, xupexist, content comment, content rating, content summary, download category, file demo, user timezone, and user xup in the affected PHP files.

Correção

Identificadores relacionados

CVE-2005-4224

Produtos afetados

E107

Referências · 11

• http://osvdb.org/21659 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4224 · Nota de Segurança
• http://osvdb.org/21657 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4224 · Nota
• http://osvdb.org/21658 · Nota
• http://glide.stanford.edu/yichen/research/sec.pdf · Nota
• http://securityfocus.com/archive/1/419280/100/0/threaded · Nota
• http://osvdb.org/21660 · Nota
• http://vupen.com/english/advisories/2005/2861 · Nota
• http://securityfocus.com/archive/1/419487/100/0/threaded · Nota
• http://secunia.com/advisories/18023 · Aviso do Fabricante