PT-2008-4970 · Magicscripts · Magicscripts E-Store Kit-1 Pro Paypal Edition+3

Mr.Sql · Publicado 2008-08-11 · Atualizado 2017-09-29 · CVE-2008-3594

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MagicScripts E-Store Kit-1 (affected versions not specified) MagicScripts E-Store Kit-2 (affected versions not specified) MagicScripts E-Store Kit-1 Pro PayPal Edition (affected versions not specified) MagicScripts E-Store Kit-2 PayPal Edition (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the pid parameter in the viewdetails.php file.

Recommendations For MagicScripts E-Store Kit-1, consider restricting access to the viewdetails.php file until a fix is available. For MagicScripts E-Store Kit-2, avoid using the pid parameter in the viewdetails.php file until the issue is resolved. For MagicScripts E-Store Kit-1 Pro PayPal Edition, restrict the use of the viewdetails.php file to minimize the risk of exploitation. For MagicScripts E-Store Kit-2 PayPal Edition, as a temporary workaround, consider disabling the viewdetails.php file until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-3594

Produtos afetados

Magicscripts E-Store Kit-1

Magicscripts E-Store Kit-1 Pro Paypal Edition

Magicscripts E-Store Kit-2

Magicscripts E-Store Kit-2 Paypal Edition

Referências · 6

• 🔥 https://exploit-db.com/exploits/6193 · Exploit
• 🔥 http://securityfocus.com/bid/30524 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3594 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44159 · Nota
• http://securityreason.com/securityalert/4139 · Nota
• http://secunia.com/advisories/31273 · Nota