PT-2007-4937 · Avtutorial · Av Tutorial Script

Publicado 2007-07-11 · Atualizado 2017-07-29 · CVE-2007-3691

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AV Tutorial Script (avtutorial) version 1.0

Description The issue is related to SQL injection vulnerabilities in the changePW.php file. When magic quotes gpc is disabled, remote attackers can execute arbitrary SQL commands via the id and userid parameters.

Recommendations For AV Tutorial Script (avtutorial) version 1.0, consider disabling the changePW.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent SQL injection attacks. Avoid using the id and userid parameters in the changePW.php file until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-3691

Produtos afetados

Av Tutorial Script

Referências · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/35487 · Nota
• http://secunia.com/advisories/25969 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-3691 · Nota de Segurança
• http://attrition.org/pipermail/vim/2007-July/001705.html · Nota
• http://osvdb.org/36298 · Nota