PT-2008-5458 · Unknown · Zanfi Cms Lite+1

Cru3L.B0Y · Publicado 2008-09-22 · Atualizado 2017-09-29 · CVE-2008-4159

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jaw Portal (affected versions not specified) Zanfi CMS lite (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary SQL commands via the pageid parameter in the "index.php" file. This can be exploited by sending a malicious request to the /index.php endpoint.

Recommendations For Jaw Portal, update the index.php file to properly sanitize the pageid parameter to prevent SQL injection. For Zanfi CMS lite, update the index.php file to properly sanitize the pageid parameter to prevent SQL injection. As a temporary workaround, consider restricting access to the index.php file until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-4159

Produtos afetados

Jaw Portal

Zanfi Cms Lite

Referências · 5

• 🔥 https://exploit-db.com/exploits/6423 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45029 · Nota
• http://securityreason.com/securityalert/4283 · Nota
• http://securityfocus.com/bid/31116 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4159 · Nota de Segurança