PT-2005-4914 · Phpwebthings · Phpwebthings

Publicado 2005-12-14 · Atualizado 2018-10-19 · CVE-2005-4226

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpWebThings version 1.4

Description The issue allows remote attackers to execute arbitrary SQL commands via several parameters in different PHP files, including ref in "download.php", direction, msg, sforum, reason, subname, and toform in "forum.php", msg and forum in "forum edit.php" and "forum write.php", tekst in "guestbook.php", menuoption in "index.php", and sel avatar in "myaccount.php".

Recommendations For phpWebThings version 1.4, consider updating to a patched version to resolve the issue. As a temporary workaround, restrict access to the vulnerable parameters in the affected PHP files until a patch is available. Avoid using the parameters ref, direction, msg, sforum, reason, subname, toform, tekst, menuoption, and sel avatar in their respective API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-4226

Produtos afetados

Phpwebthings

Referências · 16

• 🔥 https://exploit-db.com/exploits/1325 · Exploit
• 🔥 https://exploit-db.com/exploits/1324 · Exploit
• http://osvdb.org/21652 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23565 · Nota
• http://secunia.com/advisories/18011 · Aviso do Fabricante
• http://glide.stanford.edu/yichen/research/sec.pdf · Nota
• http://osvdb.org/21656 · Nota
• http://securityfocus.com/archive/1/419280/100/0/threaded · Nota
• http://securityfocus.com/archive/1/419487/100/0/threaded · Nota
• http://osvdb.org/21650 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4226 · Nota de Segurança
• http://vupen.com/english/advisories/2005/2860 · Nota
• http://osvdb.org/21651 · Nota
• http://osvdb.org/21654 · Nota
• http://osvdb.org/21655 · Nota