PT-2008-2127 · Bigware · Bigware Shop

D4M14N · Publicado 2008-01-30 · Atualizado 2017-09-29 · CVE-2008-0498

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bigware Shop version 2.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the pollid parameter in a results action to the "main bigware 53.php" endpoint.

Recommendations For Bigware Shop version 2.0, avoid using the pollid parameter in the "main bigware 53.php" endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the "main bigware 53.tpl.php" template to minimize the risk of exploitation.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-0498

Produtos afetados

Bigware Shop

Referências · 7

• 🔥 http://securityfocus.com/bid/27489 · Exploit
• 🔥 https://exploit-db.com/exploits/5002 · Exploit
• http://vupen.com/english/advisories/2008/0351 · Nota
• http://secunia.com/advisories/28691 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40010 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0498 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0498 · Nota