PT-2006-1659 · Hinton Design · Phphg Guestbook

Aliaksandr Hartsuyeu · Publicado 2006-02-08 · Atualizado 2018-10-19 · CVE-2006-0602

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Hinton Design phphg Guestbook version 1.2

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the username parameter to "check.php" or the id parameter to several admin endpoints, including "admin/edit smilie.php", "admin/add theme.php", "admin/ban ip.php", "admin/add lang.php", or "admin/edit filter.php".

Recommendations For Hinton Design phphg Guestbook version 1.2, consider restricting access to the mentioned admin endpoints and validating user input for the username and id parameters to prevent SQL injection attacks. As a temporary workaround, avoid using the username parameter in "check.php" and the id parameter in the affected admin endpoints until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2006-0602

Produtos afetados

Phphg Guestbook

Referências · 7

• 🔥 http://evuln.com/vulns/58/summary.html · Exploit
• 🔥 http://securitytracker.com/id?1015620 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0602 · Nota de Segurança
• http://vupen.com/english/advisories/2006/0480 · Aviso do Fabricante
• http://securityfocus.com/archive/1/424740/100/0/threaded · Nota
• http://secunia.com/advisories/18758 · Aviso do Fabricante
• http://securityfocus.com/bid/16541 · Nota