PT-2007-6931 · Toko Instan · Toko Instan

K1Tk4T · Publicado 2007-11-15 · Atualizado 2017-09-29 · CVE-2007-6004

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Toko Instan version 7.6

Description The issue concerns SQL injection vulnerabilities in the index.php file. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. This can be achieved via two parameters: the id parameter in an 'artikel' action or the katid parameter in a 'produk' action.

Recommendations For Toko Instan version 7.6, consider restricting access to the id and katid parameters in the 'artikel' and 'produk' actions, respectively, until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoint.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2007-6004

Produtos afetados

Toko Instan

Referências · 5

• 🔥 https://exploit-db.com/exploits/4623 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38449 · Nota
• http://securityfocus.com/bid/26433 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6004 · Nota de Segurança
• http://vupen.com/english/advisories/2007/3906 · Nota