PT-2008-3685 · Cplinks · Cplinks

Fisher762 + 1 · Publicado 2008-05-13 · Atualizado 2017-09-29 · CVE-2008-2180

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cpLinks version 1.03

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the admin username parameter to "admin/index.php" and the search text and search category parameters to "search.php", when magic quotes gpc is disabled.

Recommendations For cpLinks version 1.03, consider disabling the use of the admin username, search text, and search category parameters until a patch is available. Additionally, enabling magic quotes gpc can help mitigate the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-2180

Produtos afetados

Cplinks

Referências · 6

• 🔥 https://exploit-db.com/exploits/5538 · Exploit
• http://secunia.com/advisories/30024 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-2180 · Nota de Segurança
• http://vupen.com/english/advisories/2008/1431/references · Nota
• http://securityfocus.com/bid/29035 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42170 · Nota