PT-2007-4529 · Elxis · Elxis Cms

Nico Leidecker · Publicado 2007-06-18 · Atualizado 2018-10-16 · CVE-2007-3250

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Elxis CMS versions prior to 2006.4 20070613

Description: The issue allows remote attackers to execute arbitrary SQL commands via the mb tracker cookie in the mod banners.php file. This can lead to unauthorized access and manipulation of database content. The product was patched without updating the version number, so later downloads of version 2006.4 are not affected.

Recommendations: For versions prior to 2006.4 20070613, as a temporary workaround, consider restricting access to the mod banners.php file until a patched version can be downloaded. Avoid using the mb tracker cookie in the affected module to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-3250

Produtos afetados

Elxis Cms

Referências · 10

• http://vupen.com/english/advisories/2007/2218 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3250 · Nota de Segurança
• http://elxis.org/index.php?option=com_mtree&task=viewlink&link_id=98&Itemid=140 · Correção
• http://securityfocus.com/bid/24478 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3250 · Nota
• http://securityfocus.com/archive/1/471399/100/0/threaded · Nota
• http://securityreason.com/securityalert/2806 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34873 · Nota
• http://secunia.com/advisories/25684 · Nota
• http://osvdb.org/36305 · Nota