PT-2007-5289 · Alstrasoft · Alstrasoft Video Share Enterprise

Publicado 2007-07-30 · Atualizado 2008-11-15 · CVE-2007-4086

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlstraSoft Video Share Enterprise (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the gid parameter to "gmembers.php", or the UID parameter to several pages, including "uvideos.php", "ugroups.php", "uprofile.php", "ufavour.php", "ufriends.php", and "uplaylist.php".

Recommendations As a temporary workaround, consider restricting access to the gid parameter in "gmembers.php" and the UID parameter in the affected pages until a patch is available. Avoid using the gid and UID parameters in the respective API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2007-4086

Produtos afetados

Alstrasoft Video Share Enterprise

Referências · 9

• 🔥 http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html · Exploit
• http://osvdb.org/37878 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4086 · Nota de Segurança
• http://osvdb.org/37874 · Nota
• http://osvdb.org/37875 · Nota
• http://osvdb.org/37876 · Nota
• http://osvdb.org/37872 · Nota
• http://osvdb.org/37877 · Nota
• http://osvdb.org/37873 · Nota