PT-2006-3682 · Pre · Pre News Manager

K-159 + 1 · Publicado 2006-06-02 · Atualizado 2018-10-18 · CVE-2006-2763

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pre News Manager version 1.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the id parameter to "index.php" and the nid parameter to several other scripts, including "news detail.php", "email story.php", "thankyou.php", "printable view.php", "tella friend.php", and "send comments.php".

Recommendations For Pre News Manager version 1.0, consider restricting access to the vulnerable parameters id and nid in the affected scripts until a patch is available. As a temporary workaround, avoid using the id parameter in "index.php" and the nid parameter in the other mentioned scripts.

Exploit

Correção

Identificadores relacionados

CVE-2006-2763

Produtos afetados

Pre News Manager

Referências · 17

• 🔥 https://exploit-db.com/exploits/3841 · Exploit
• 🔥 https://exploit-db.com/exploits/5803 · Exploit
• http://osvdb.org/26075 · Nota
• http://osvdb.org/26077 · Nota
• http://osvdb.org/26074 · Nota
• http://osvdb.org/26076 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2763 · Nota de Segurança
• http://securityfocus.com/archive/1/497185/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43070 · Nota
• http://securityfocus.com/archive/1/497219/100/0/threaded · Nota
• http://osvdb.org/26079 · Nota
• http://osvdb.org/26073 · Nota
• http://secunia.com/advisories/20284 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/1990 · Nota
• http://osvdb.org/26078 · Nota