PT-2006-4009 · Chipmailer · Chipmailer

Tamriel · Publicado 2006-06-21 · Atualizado 2017-07-20 · CVE-2006-3111

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Chipmailer version 1.09

Description The issue allows remote attackers to execute arbitrary SQL commands via multiple parameters in the main.php file. The vulnerable parameters include anfang, name, mail, anrede, vorname, nachname, gebtag, gebmonat, and gebjahr.

Recommendations For Chipmailer version 1.09, consider restricting access to the main.php file until a patch is available. As a temporary workaround, avoid using the parameters anfang, name, mail, anrede, vorname, nachname, gebtag, gebmonat, and gebjahr in the affected API endpoint.

Correção

Identificadores relacionados

CVE-2006-3111

Produtos afetados

Chipmailer

Referências · 7

• http://marc.info/?l=bugtraq&m=115024576618386&w=2 · Nota
• http://securitytracker.com/id?1016315 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27158 · Nota
• http://secunia.com/advisories/20643 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-3111 · Nota de Segurança
• http://securityfocus.com/bid/18463 · Nota
• http://vupen.com/english/advisories/2006/2359 · Nota