PT-2008-3979 · Blizzard · Battle.Net Clan Script For Php

Stack-Terrorist · Publicado 2008-06-03 · Atualizado 2017-09-29 · CVE-2008-2522

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Battle.net Clan Script for PHP versions 1.5.3 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible when the magic quotes gpc setting is disabled. The exploitation occurs through the showmember parameter in a members action.

Recommendations For Battle.net Clan Script for PHP versions 1.5.3 and earlier, consider disabling the members.php file or restricting access to it until a fix is available. As a temporary workaround, enable the magic quotes gpc setting to prevent SQL injection attacks. Avoid using the showmember parameter in the members action until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-2522

Produtos afetados

Battle.Net Clan Script For Php

Referências · 5

• 🔥 https://exploit-db.com/exploits/5597 · Exploit
• http://securityfocus.com/bid/29166 · Nota
• http://secunia.com/advisories/30211 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-2522 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42354 · Nota