PT-2007-7325 · Kvaliitti · Kvaliitti Webdoc

Chrysalid + 1 · Publicado 2007-12-20 · Atualizado 2018-10-15 · CVE-2007-6491

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kvaliitti WebDoc version 3.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the cat id parameter to "categories.asp", and probably via the document id parameter to "categories.asp", as well as the cat id and document id parameters to "subcategory.asp".

Recommendations For Kvaliitti WebDoc version 3.0, consider restricting access to the vulnerable parameters cat id and document id in the affected API endpoints "categories.asp" and "subcategory.asp" until a patch is available. Avoid using these parameters in the respective endpoints to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2007-6491

Produtos afetados

Kvaliitti Webdoc

Referências · 5

• http://osvdb.org/43709 · Nota
• http://osvdb.org/43710 · Nota
• http://securityfocus.com/archive/1/484758/100/100/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6491 · Nota de Segurança
• http://securityreason.com/securityalert/3473 · Nota