PT-2007-1048 · Just For Fun · Jffnms
Tim Brown
·
Publicado
2007-06-12
·
Atualizado
2018-10-16
·
CVE-2007-3190
CVSS v2.0
9.4
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions:
Just For Fun Network Management System (JFFNMS) version 0.8.3
Description:
The issue concerns multiple SQL injection vulnerabilities in the auth.php file of JFFNMS. When magic quotes gpc is disabled, remote attackers can execute arbitrary SQL commands via the
user and pass parameters. This could potentially lead to a breach of confidentiality and integrity of protected information. The exploitation of these vulnerabilities can be done remotely.Recommendations:
For JFFNMS version 0.8.3, consider disabling the
auth.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent SQL injection attacks. Avoid using the user and pass parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Jffnms