PT-2007-5287 · Alstrasoft · Alstrasoft Affiliate Network Pro

Publicado 2007-07-30 · Atualizado 2008-11-15 · CVE-2007-4084

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlstraSoft Affiliate Network Pro (affected versions not specified)

Description The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved via the pgmid parameter in an uploadProducts action to "merchants/index.php" and possibly the rowid parameter to "merchants/temp.php".

Recommendations For AlstraSoft Affiliate Network Pro, consider restricting access to the merchants/index.php and merchants/temp.php scripts until a fix is available. As a temporary workaround, avoid using the pgmid and rowid parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-4084

Produtos afetados

Alstrasoft Affiliate Network Pro

Referências · 6

• 🔥 https://exploit-db.com/exploits/30371 · Exploit
• 🔥 http://securityfocus.com/bid/25026 · Exploit
• 🔥 http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html · Exploit
• http://osvdb.org/37869 · Nota
• http://osvdb.org/37870 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4084 · Nota de Segurança