PT-2006-3245 · Saphplesson · Saphplesson

O Y 6 Hotmail Com · Publicado 2006-05-09 · Atualizado 2018-10-18 · CVE-2006-2279

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SaphpLesson version 3.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the Find parameter in the "search.php" API endpoint, and the LID and Rate parameters in the "misc.php" API endpoint.

Recommendations For SaphpLesson version 3.0, consider restricting access to the "search.php" and "misc.php" API endpoints until a patch is available. As a temporary workaround, avoid using the Find, LID, and Rate parameters in these endpoints to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-2279

Produtos afetados

Saphplesson

Referências · 9

• http://osvdb.org/25362 · Nota
• http://securityfocus.com/bid/17848 · Nota
• http://vupen.com/english/advisories/2006/1708 · Nota
• http://securityfocus.com/archive/1/433052/100/0/threaded · Nota
• http://securityreason.com/securityalert/862 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26293 · Nota
• http://osvdb.org/25363 · Nota
• http://secunia.com/advisories/20034 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-2279 · Nota de Segurança