PT-2007-2405 · Webtester · Webtester

Moran Zavdi · Publicado 2007-02-16 · Atualizado 2018-10-16 · CVE-2007-0970

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: WebTester versions 5.0.20060927 and earlier

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the testID parameter to "directions.php", and unspecified parameters to other files that accept GET or POST input.

Recommendations: For versions 5.0.20060927 and earlier, avoid using the testID parameter in the "directions.php" file until the issue is resolved. Restrict access to files that accept GET or POST input to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-0970

Produtos afetados

Webtester

Referências · 10

• 🔥 https://exploit-db.com/exploits/29602 · Exploit
• 🔥 http://securityfocus.com/bid/22559 · Exploit
• http://vupen.com/english/advisories/2007/0633 · Nota
• http://securityreason.com/securityalert/2261 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0970 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32490 · Nota
• http://osvdb.org/33204 · Nota
• http://secunia.com/advisories/24157 · Nota
• http://osvdb.org/33203 · Nota
• http://securityfocus.com/archive/1/460078/100/0/threaded · Nota