PT-2006-4485 · Orbitmatrix · Orbitmatrix

Publicado 2006-07-14 · Atualizado 2018-10-18 · CVE-2006-3610

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OrbitMATRIX version 1.0

Description The issue allows remote attackers to obtain sensitive information, specifically partial database schema, by modifying the page name parameter in index.php. This modification reflects portions of an SQL query in the result. However, it is unclear whether the exposed information is target-specific.

Recommendations For OrbitMATRIX version 1.0, consider restricting access to the index.php file or modifying the page name parameter handling to prevent SQL query reflection until a proper fix is available. As a temporary workaround, avoid using the page name parameter in the affected endpoint.

Correção

Identificadores relacionados

CVE-2006-3610

Produtos afetados

Orbitmatrix

Referências · 2

• http://securityfocus.com/archive/1/439970/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3610 · Nota de Segurança