PT-2008-4681 · Com Dtregister · Dt Register

His0K4

·

Publicado

2008-07-24

·

Atualizado

2017-09-29

·

CVE-2008-3265

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: DT Register (com dtregister) version 2.2.3
Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the eventId parameter in a "pay options" action to "index.php".
Recommendations: For version 2.2.3, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the "pay options" action in "index.php" to minimize the risk of exploitation. Avoid using the eventId parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-3265

Produtos afetados

Dt Register