PT-2007-3006 · Realguestbook · Realguestbook

Publicado 2007-03-23 · Atualizado 2011-03-08 · CVE-2007-1624

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions realGuestbook version 5.01

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in the name, email, homepage, and text parameters to save entry.php, which can be reached through add entry.php. There may be other unspecified parameters and files that are also vulnerable.

Recommendations For realGuestbook version 5.01, consider restricting access to the save entry.php file and validating user input for the name, email, homepage, and text parameters to prevent SQL injection attacks. As a temporary workaround, consider disabling the save entry.php file until a patch is available.

Correção

Identificadores relacionados

CVE-2007-1624

Produtos afetados

Realguestbook

Referências · 5

• http://vupen.com/english/advisories/2007/1060 · Nota
• http://secunia.com/advisories/24602 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-1624 · Nota de Segurança
• http://osvdb.org/34342 · Nota
• http://securityfocus.com/bid/23072 · Nota