PT-2006-4139 · Anthill · Anthill

Publicado 2006-06-27 · Atualizado 2017-07-20 · CVE-2006-3244

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Anthill versions 0.2.6 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the order parameter in "buglist.php" and the bug parameter in "query.php".

Recommendations For Anthill versions 0.2.6 and earlier, consider disabling the order parameter in buglist.php and the bug parameter in query.php as a temporary workaround until a patch is available. Restrict access to buglist.php and query.php to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-3244

Produtos afetados

Anthill

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-3244 · Nota de Segurança
• http://secunia.com/advisories/20838 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/2529 · Nota
• http://securityfocus.com/bid/18661 · Nota
• http://pridels0.blogspot.com/2006/06/anthill-sql-injection-vuln.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27373 · Nota