PT-2008-3533 · Postnuke · Postnuke Pnflashgames Module

Kacper · Publicado 2008-04-30 · Atualizado 2017-09-29 · CVE-2008-2013

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostNuke pnFlashGames module versions 1.5 through 2.5

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible when the magic quotes gpc setting is disabled. The id parameter in a display action is vulnerable to SQL injection.

Recommendations For PostNuke pnFlashGames module versions 1.5 through 2.5, consider disabling the display action until a patch is available, and ensure magic quotes gpc is enabled to mitigate the risk of SQL injection via the id parameter.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-2013

Produtos afetados

Postnuke Pnflashgames Module

Referências · 4

• 🔥 http://securityfocus.com/bid/28948 · Exploit
• 🔥 https://exploit-db.com/exploits/5500 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42019 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2013 · Nota de Segurança