PT-2007-2562 · Webmplayer · Webmplayer

Publicado 2007-02-27 · Atualizado 2011-03-08 · CVE-2007-1135

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebMplayer versions prior to 0.6.1-Alpha

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the strid parameter to "index.php" or the id[0] or other id array index parameter to "filecheck.php".

Recommendations For versions prior to 0.6.1-Alpha, update to version 0.6.1-Alpha or later to resolve the issue. As a temporary workaround, consider restricting access to the "index.php" and "filecheck.php" endpoints to minimize the risk of exploitation. Avoid using the strid parameter in "index.php" and the id[0] or other id array index parameters in "filecheck.php" until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-1135

Produtos afetados

Webmplayer

Referências · 6

• http://osvdb.org/34443 · Nota
• http://vupen.com/english/advisories/2007/0742 · Nota
• http://securityfocus.com/bid/22726 · Nota
• http://osvdb.org/34442 · Nota
• http://sourceforge.net/project/shownotes.php?release_id=486880&group_id=172354 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2007-1135 · Nota de Segurança