PT-2008-3682 · Phpdirectorysource · Phpdirectorysource

Fisher762 + 1 · Publicado 2008-05-13 · Atualizado 2017-09-29 · CVE-2008-2177

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpDirectorySource version 1.1.06

Description The issue concerns SQL injection vulnerabilities. Remote attackers can execute arbitrary SQL commands. This is possible via the lid parameter to "show.php" and the login parameter to "admin.php" when magic quotes gpc is disabled.

Recommendations For phpDirectorySource version 1.1.06, consider disabling the magic quotes gpc feature to prevent SQL injection attacks, or update the show.php and admin.php files to properly sanitize the lid and login parameters. As a temporary workaround, restrict access to the "show.php" and "admin.php" files until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-2177

Produtos afetados

Phpdirectorysource

Referências · 7

• 🔥 https://exploit-db.com/exploits/5537 · Exploit
• http://vupen.com/english/advisories/2008/1432/references · Nota
• http://securityfocus.com/bid/29039 · Nota
• http://secunia.com/advisories/30056 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42213 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42212 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2177 · Nota de Segurança