PT-2005-5104 · Honeycomb · Honeycomb Archive+1

Publicado 2005-12-20 · Atualizado 2017-07-20 · CVE-2005-4419

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Honeycomb Archive versions 3.0 Honeycomb Archive Enterprise versions 3.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in the CategoryResults.cfm file. The vulnerable parameters are series, cat parent, cat, and div.

Recommendations For Honeycomb Archive version 3.0, update to a version that includes a fix for the SQL injection vulnerabilities. For Honeycomb Archive Enterprise version 3.0, update to a version that includes a fix for the SQL injection vulnerabilities. As a temporary workaround, consider restricting access to the CategoryResults.cfm file until a patch is available. Avoid using the parameters series, cat parent, cat, and div in the affected CategoryResults.cfm file until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-4419

Produtos afetados

Honeycomb Archive

Honeycomb Archive Enterprise

Referências · 8

• 🔥 https://exploit-db.com/exploits/26920 · Exploit
• http://osvdb.org/21827 · Nota
• http://pridels0.blogspot.com/2005/12/honeycomb-archive-honeycomb-archive.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23829 · Nota
• http://securityfocus.com/bid/15995 · Nota
• http://attrition.org/pipermail/vim/2006-March/000580.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4419 · Nota de Segurança
• http://secunia.com/advisories/18127 · Nota