PT-2006-2798 · Musicbox · Musicbox

Publicado 2006-04-18 · Atualizado 2018-10-18 · CVE-2006-1807

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Musicbox versions 2.3.3 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the start parameter in a "search" action or the type parameter in a "top" action.

Recommendations For Musicbox versions 2.3.3 and earlier, update to a version later than 2.3.3 to resolve the issue. As a temporary workaround, consider restricting access to the index.php file or disabling the search and top actions until a patch is available. Avoid using the start and type parameters in the affected actions until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-1807

Produtos afetados

Musicbox

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2006-1807 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25836 · Nota
• http://securityfocus.com/bid/17545 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27926 · Nota
• http://vupen.com/english/advisories/2006/1373 · Nota
• http://securityfocus.com/archive/1/441000/100/0/threaded · Nota
• http://pridels0.blogspot.com/2006/04/musicbox-vuln.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1807 · Nota
• http://secunia.com/advisories/19672 · Aviso do Fabricante