PT-2008-4355 · Pre Ads · Pre Ads Portal

M.Hasran Addahroni · Publicado 2008-06-30 · Atualizado 2018-10-11 · CVE-2008-2916

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pre ADS Portal versions 2.0 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the cid parameter to "showcategory.php" and the id parameter to "software-description.php" when magic quotes gpc is disabled.

Recommendations For Pre ADS Portal versions 2.0 and earlier, consider disabling the execution of SQL commands via the cid and id parameters in "showcategory.php" and "software-description.php" respectively, until a patch is available. Additionally, enabling magic quotes gpc can help mitigate the risk of SQL injection attacks.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-2916

Produtos afetados

Pre Ads Portal

Referências · 8

• 🔥 http://e-rdc.org/v1/news.php?readmore=98 · Exploit
• 🔥 https://exploit-db.com/exploits/5804 · Exploit
• 🔥 http://securityfocus.com/bid/29709 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-2916 · Nota de Segurança
• http://securityreason.com/securityalert/3963 · Nota
• http://secunia.com/advisories/30689 · Aviso do Fabricante
• http://securityfocus.com/archive/1/493371/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43071 · Nota