PT-2008-1910 · Eticket · Eticket

Publicado 2008-01-15 · Atualizado 2018-10-15 · CVE-2008-0266

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions eTicket version 1.5.5.2

Description A cross-site request forgery (CSRF) issue in the admin.php file allows remote attackers to change the administrative password and possibly perform other administrative tasks, provided they either know the old password or can leverage a separate SQL injection vulnerability.

Recommendations For eTicket version 1.5.5.2, as a temporary workaround, consider restricting access to the admin.php file until a patch is available. Additionally, ensure that the old password is not known to unauthorized parties and mitigate the risk of SQL injection vulnerabilities to prevent leverage by attackers.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-0266

Produtos afetados

Eticket

Referências · 8

• 🔥 http://securityfocus.com/bid/27173 · Exploit
• 🔥 https://exploit-db.com/exploits/30994 · Exploit
• http://secunia.com/advisories/28331 · Aviso do Fabricante
• http://securityfocus.com/archive/1/485835/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0266 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39490 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0266 · Nota
• http://securityreason.com/securityalert/3542 · Nota