PT-2008-4703 · Webligo Developments · Socialengine

Tim Loshak · Publicado 2008-07-25 · Atualizado 2018-10-11 · CVE-2008-3297

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: SocialEngine versions prior to 2.83

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via an se user cookie to the "include/class user.php" endpoint or an se admin cookie to the "include/class admin.php" endpoint.

Recommendations: For versions prior to 2.83, update to version 2.83 or later to resolve the issue. As a temporary workaround, consider restricting access to the include/class user.php and include/class admin.php endpoints until the update is applied. Avoid using the se user and se admin cookies in these endpoints until the issue is resolved.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-3297

Produtos afetados

Socialengine

Referências · 7

• http://securityfocus.com/bid/30342 · Nota
• http://securityfocus.com/archive/1/494638/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43958 · Nota
• http://secunia.com/advisories/31203 · Aviso do Fabricante
• http://securityreason.com/securityalert/4035 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3297 · Nota de Segurança
• http://socialengine.net/news.php · Correção