PT-2007-5359 · Indexscript · Indexscript

Publicado 2007-08-03 · Atualizado 2008-11-15 · CVE-2007-4163

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IndexScript versions 2.7 and 2.8 before 20070726

Description The issue allows remote attackers to execute arbitrary SQL commands via the cat id, start id, row[parent id], and row[cat id] parameters. This is related to the use of these parameters within the include/utils.php component.

Recommendations For IndexScript versions 2.7 and 2.8 before 20070726, consider restricting access to the parameters cat id, start id, row[parent id], and row[cat id] in the affected components until a fix is available. As a temporary workaround, avoid using these parameters in the include/utils.php file to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-4163

Produtos afetados

Indexscript

Referências · 3

• http://osvdb.org/46989 · Nota
• http://indexscript.com/forum/showthread.php?t=2266 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2007-4163 · Nota de Segurança