PT-2008-3267 · Knowledgequest · Knowledgequest

Hadihadi · Publicado 2008-04-11 · Atualizado 2017-09-29 · CVE-2008-1726

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions KnowledgeQuest version 2.6

Description The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities. This is possible when the magic quotes gpc setting is disabled. The vulnerabilities can be exploited through specific parameters in various PHP files, including the kqid parameter in "articletext.php" and "articletextonly.php", and the username parameter in "logincheck.php".

Recommendations For KnowledgeQuest version 2.6, consider disabling the kqid parameter in "articletext.php" and "articletextonly.php" and the username parameter in "logincheck.php" until a patch is available. Additionally, enabling the magic quotes gpc setting can help mitigate the risk of SQL injection attacks.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-1726

Produtos afetados

Knowledgequest

Referências · 9

• 🔥 https://exploit-db.com/exploits/5421 · Exploit
• 🔥 http://securityfocus.com/bid/28713 · Exploit
• 🔥 http://securityfocus.com/bid/28716 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41746 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1726 · Nota de Segurança
• http://osvdb.org/44255 · Nota
• http://osvdb.org/44256 · Nota
• http://secunia.com/advisories/29716 · Aviso do Fabricante
• http://osvdb.org/44254 · Nota