PT-2007-2934 · Phpx · Phpx

Publicado 2007-03-20 · Atualizado 2018-10-16 · CVE-2007-1550

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpx version 3.5.15

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters to different PHP files, including image id or cat id to "gallery.php", news id to "news.php" or "print.php", news cat id to "news.php", cat id, topic id, or post id to "forums.php", or user id to "users.php".

Recommendations For phpx version 3.5.15, consider restricting access to the vulnerable parameters image id, cat id, news id, news cat id, cat id, topic id, post id, and user id in their respective PHP files until a patch is available. As a temporary workaround, disabling the execution of arbitrary SQL commands via these parameters can help minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-1550

Produtos afetados

Phpx

Referências · 17

• 🔥 https://exploit-db.com/exploits/29756 · Exploit
• 🔥 https://exploit-db.com/exploits/29757 · Exploit
• 🔥 https://exploit-db.com/exploits/29759 · Exploit
• 🔥 https://exploit-db.com/exploits/29760 · Exploit
• 🔥 https://exploit-db.com/exploits/29758 · Exploit
• http://osvdb.org/34416 · Nota
• http://osvdb.org/34414 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1550 · Nota de Segurança
• http://osvdb.org/34415 · Nota
• http://vupen.com/english/advisories/2007/1087 · Nota
• http://osvdb.org/34418 · Nota
• http://securityreason.com/securityalert/2457 · Nota
• http://securityfocus.com/archive/1/463192/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33155 · Nota
• http://osvdb.org/34417 · Nota