PT-2006-3866 · Snitz · Snitz Forums

Farhadkey · Publicado 2006-06-12 · Atualizado 2018-10-18 · CVE-2006-2959

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Snitz Forum versions 3.4.05 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the GROUP parameter in a cookie, specifically through the %strCookieURL%.GROUP parameter.

Recommendations For Snitz Forum versions 3.4.05 and earlier, update to a version later than 3.4.05 to resolve the issue. As a temporary workaround, consider restricting access to the inc header.asp file until a patch is available. Avoid using the GROUP parameter in cookies for the affected versions until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-2959

Produtos afetados

Snitz Forums

Referências · 8

• 🔥 http://kapda.ir/advisory-343.html · Exploit
• http://securityfocus.com/bid/18362 · Nota
• http://securitytracker.com/id?1016267 · Nota
• http://forum.snitz.com/forum/topic.asp?TOPIC_ID=62049 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27080 · Nota
• http://securityreason.com/securityalert/1075 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2959 · Nota de Segurança
• http://securityfocus.com/archive/1/436702/100/0/threaded · Nota