PT-2005-5224 · Dev · Dev Web Management System

Publicado 2005-12-28 · Atualizado 2018-10-19 · CVE-2005-4554

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DEV web management system versions 1.5 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the cat parameter in an openforum action in index.php, the cat parameter in getfile.php, and the target parameter in download now.php.

Recommendations For DEV web management system versions 1.5 and earlier, update to a version later than 1.5 to resolve the issue. As a temporary workaround, consider restricting access to the openforum action in index.php, getfile.php, and download now.php to minimize the risk of exploitation. Avoid using the cat parameter in index.php and getfile.php and the target parameter in download now.php until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-4554

Produtos afetados

Dev Web Management System

Referências · 13

• 🔥 https://exploit-db.com/exploits/26977 · Exploit
• 🔥 https://exploit-db.com/exploits/1387 · Exploit
• 🔥 http://secunia.com/advisories/18239 · Exploit
• 🔥 http://securityfocus.com/bid/16063 · Exploit
• 🔥 http://securitytracker.com/id?1015410 · Exploit
• 🔥 http://rgod.altervista.org/dev_15_sql_xpl.html · Exploit
• 🔥 https://exploit-db.com/exploits/26976 · Exploit
• http://securityfocus.com/archive/1/420253/100/0/threaded · Nota
• http://osvdb.org/22041 · Nota
• http://osvdb.org/22040 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23898 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4554 · Nota de Segurança
• http://osvdb.org/22042 · Nota