PT-2006-3894 · Dominios Europa · Dominios Europa Picrate

Publicado 2006-06-13 · Atualizado 2017-07-20 · CVE-2006-2987

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dominios Europa PICRATE (aka TAL RateMyPic) version 1.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters to specific API endpoints, including id, voteid, and vfiel parameters to "index.php", and nick, email, city, messen, and message form field parameters to "add.php".

Recommendations For Dominios Europa PICRATE (aka TAL RateMyPic) version 1.0, consider restricting access to the "index.php" and "add.php" endpoints until a patch is available. As a temporary workaround, avoid using the id, voteid, vfiel, nick, email, city, messen, and message parameters in the affected API endpoints.

Correção

Identificadores relacionados

CVE-2006-2987

Produtos afetados

Dominios Europa Picrate

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2006-2987 · Nota de Segurança
• http://vupen.com/english/advisories/2006/2118 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27017 · Nota
• http://secunia.com/advisories/20414 · Aviso do Fabricante