PT-2007-4886 · Gamesitescript · Gamesitescript

Xenduer77 · Publicado 2007-07-10 · Atualizado 2017-09-29 · CVE-2007-3631

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GameSiteScript (gss) versions 3.1 and earlier

Description The issue is related to a SQL injection vulnerability in the index.php file. This vulnerability allows remote attackers to execute arbitrary SQL commands via the params parameter, specifically due to missing input validation of the id field.

Recommendations For GameSiteScript (gss) versions 3.1 and earlier, consider validating user input for the id field in the params parameter to prevent SQL injection attacks. As a temporary workaround, restrict access to the index.php file until a proper fix is applied.

Exploit

Correção

Identificadores relacionados

CVE-2007-3631

Produtos afetados

Gamesitescript

Referências · 7

• 🔥 https://exploit-db.com/exploits/4159 · Exploit
• http://securityfocus.com/bid/24807 · Nota
• http://secunia.com/advisories/25983 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35292 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3631 · Nota de Segurança
• http://osvdb.org/36362 · Nota
• http://vupen.com/english/advisories/2007/2460 · Nota