PT-2007-7092 · Neocrome · Neocrome Seditio Cms

Inateam · Publicado 2007-12-01 · Atualizado 2017-09-29 · CVE-2007-6202

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Neocrome Seditio CMS versions 121 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the pag sub[] parameter to "plug.php".

Recommendations For Neocrome Seditio CMS versions 121 and earlier, update to a version later than 121 to resolve the issue. As a temporary workaround, consider restricting access to the "plug.php" endpoint to minimize the risk of exploitation. Avoid using the pag sub[] parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2007-6202

Produtos afetados

Neocrome Seditio Cms

Referências · 8

• 🔥 http://securityfocus.com/bid/26655 · Exploit
• 🔥 https://exploit-db.com/exploits/4678 · Exploit
• http://osvdb.org/38924 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6202 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6202 · Nota de Segurança
• http://neocrome.net/page.php?id=2349 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38774 · Nota
• http://secunia.com/advisories/27881 · Aviso do Fabricante