PT-2006-2686 · Unknown · Mwnewsletter

Publicado 2006-04-11 · Atualizado 2011-03-08 · CVE-2006-1692

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: MWNewsletter version 1.0.0b

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the user email parameter to "unsubscribe.php" or "subscribe.php", or the user name parameter to "subscribe.php".

Recommendations: For MWNewsletter version 1.0.0b, avoid using the user email parameter in the "unsubscribe.php" and "subscribe.php" API endpoints, and the user name parameter in the "subscribe.php" endpoint until the issue is resolved. Restrict access to these endpoints to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-1692

Produtos afetados

Mwnewsletter

Referências · 5

• http://vupen.com/english/advisories/2006/1270 · Nota
• http://osvdb.org/24445 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1692 · Nota de Segurança
• http://osvdb.org/24905 · Nota
• http://secunia.com/advisories/19568 · Aviso do Fabricante