PT-2005-4952 · Php · Php Support Tickets

Publicado 2005-12-15 · Atualizado 2011-03-08 · CVE-2005-4264

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP Support Tickets version 2.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the username and password fields, and the id parameter.

Recommendations For PHP Support Tickets version 2.0, consider validating and sanitizing user input for the username, password, and id parameter to prevent SQL injection attacks. As a temporary workaround, restrict access to the index.php file until a patch is available.

Correção

Identificadores relacionados

CVE-2005-4264

Produtos afetados

Php Support Tickets

Referências · 8

• http://secunia.com/advisories/18067 · Nota
• http://securitytracker.com/id?1015352 · Correção
• http://nii.co.in/vuln/PHPSupportTickets.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-4264 · Nota de Segurança
• http://securityfocus.com/bid/15853 · Nota
• http://osvdb.org/21730 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4264 · Nota
• http://vupen.com/english/advisories/2005/2928 · Nota