PT-2005-5254 · Phpsurveyor · Php Surveyor

Publicado 2005-12-30 · Atualizado 2008-09-05 · CVE-2005-4586

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPSurveyor versions prior to 0.991

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the sql parameter in "browse.php" and the sid, lid, gid, and token parameters in certain PHP scripts.

Recommendations For versions prior to 0.991, update to version 0.991 or later to resolve the issue. As a temporary workaround, consider restricting access to the "browse.php" script and the parameters sid, lid, gid, and token in affected PHP scripts to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-4586

Produtos afetados

Php Surveyor

Referências · 8

• http://osvdb.org/22184 · Nota
• http://securityfocus.com/bid/16077 · Correção
• http://sourceforge.net/project/shownotes.php?release_id=381050&group_id=74605 · Correção
• http://secunia.com/advisories/18167 · Aviso do Fabricante
• http://phpsurveyor.org/mantis/view.php?id=287 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4586 · Nota de Segurança
• http://phpsurveyor.org/mantis/view.php?id=286 · Nota
• http://osvdb.org/22039 · Nota