PT-2007-3917 · Unknown · Simplenews

Silentz · CVE-2007-2598 · Publicado 2007-05-11 · Atualizado 2024-02-14

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SimpleNews version 1.0.0 FINAL

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the news id parameter in the "print.php" endpoint.

Recommendations For SimpleNews version 1.0.0 FINAL, avoid using the news id parameter in the print.php endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the print.php endpoint to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-2598

Produtos afetados

Simplenews

Referências · 8

• 🔥 https://exploit-db.com/exploits/3886 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34220 · Nota
• http://w4ck1ng.com/exploits/w4ck1ng_simplenews.txt · Nota
• http://secunia.com/advisories/25223 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2598 · Nota de Segurança
• http://vupen.com/english/advisories/2007/1741 · Nota
• http://securityfocus.com/bid/23904 · Nota
• http://osvdb.org/35910 · Nota