PT-2007-2958 · Phprojekt · Phprojekt

Publicado 2007-03-21 · Atualizado 2018-10-16 · CVE-2007-1575

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHProjekt version 5.2.0

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is possible due to multiple SQL injection vulnerabilities when the magic quotes gpc setting is disabled. The vulnerabilities are found in the calendar and search modules, as well as in an unspecified cookie when the user logs out.

Recommendations For PHProjekt version 5.2.0, consider disabling the calendar and search modules until a patch is available. Additionally, restrict access to the logout functionality to minimize the risk of exploitation. As a temporary workaround, enable the magic quotes gpc setting to prevent SQL injection attacks.

Correção

Identificadores relacionados

CVE-2007-1575

Produtos afetados

Phprojekt

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-1575 · Nota de Segurança
• http://securityfocus.com/bid/22955 · Nota
• http://phprojekt.com/index.php?name=News&file=article&sid=276 · Aviso do Fabricante
• http://secunia.com/advisories/24509 · Nota
• http://secunia.com/advisories/25748 · Nota
• http://securityfocus.com/archive/1/462789/100/0/threaded · Nota
• http://security.gentoo.org/glsa/glsa-200706-07.xml · Aviso do Fabricante
• http://securityreason.com/securityalert/2466 · Nota
• http://nruns.com/security_advisory_phprojekt_sql_injection.php · Aviso do Fabricante