PT-2006-4030 · Cms Mundo · Cms Mundo

Andreas Sandblad · Publicado 2006-07-13 · Atualizado 2017-07-20 · CVE-2006-3135

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CMS Mundo version 1.0 build 008

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters and fields, including the news id parameter in the news module, searchstring parameter in the search module, id parameter in the webshop module, username parameter in index.php, and various fields during a user profile update, such as Name, Address, Zip, City, Country, and Email.

Recommendations For CMS Mundo version 1.0 build 008, consider restricting access to the news, search, and webshop modules, and limit user profile updates until a fix is available. As a temporary workaround, avoid using the news id, searchstring, id, and username parameters in their respective modules, and be cautious with user input in the Name, Address, Zip, City, Country, and Email fields during user profile updates.

Exploit

Correção

Identificadores relacionados

CVE-2006-3135

Produtos afetados

Cms Mundo

Referências · 11

• 🔥 http://secunia.com/advisories/20589 · Exploit
• http://secunia.com/secunia_research/2006-52/advisory · Aviso do Fabricante
• http://osvdb.org/27140 · Nota
• http://osvdb.org/27141 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27712 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3135 · Nota de Segurança
• http://osvdb.org/27139 · Nota
• http://osvdb.org/27142 · Nota
• http://osvdb.org/27143 · Nota
• http://vupen.com/english/advisories/2006/2783 · Nota
• http://securityreason.com/securityalert/1236 · Nota