PT-2007-6980 · Skyportal · Skyportal

Alireza Hasani + 4 · Publicado 2007-11-21 · Atualizado 2017-09-29 · CVE-2007-6078

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SkyPortal version RC6

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via unspecified parameters to several API endpoints, including (1) "nc top.asp", (2) "inc bookmarks.asp", possibly involving a parameter passed from "cp main.asp", (3) "inc profile functions.asp", or (4) "inc SUBSCRIPTIONS.asp". Additionally, the Avatar URL, LINK1, or LINK2 parameter to "cp main.asp" in an EditIt action can be exploited.

Recommendations For SkyPortal version RC6, consider restricting access to the vulnerable API endpoints "nc top.asp", "inc bookmarks.asp", "inc profile functions.asp", "inc SUBSCRIPTIONS.asp", and "cp main.asp" until a patch is available. As a temporary workaround, avoid using the Avatar URL, LINK1, and LINK2 parameters in the "cp main.asp" endpoint with an EditIt action.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2007-6078

Produtos afetados

Skyportal

Referências · 5

• 🔥 http://securityfocus.com/bid/26504 · Exploit
• 🔥 https://exploit-db.com/exploits/4638 · Exploit
• http://kb.cert.org/vuls/id/315107 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38595 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6078 · Nota de Segurança