PT-2008-5866 · Xoops · Makale

Echoll · Publicado 2008-10-21 · Atualizado 2017-09-29 · CVE-2008-4653

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Makale versions 0.26 and possibly other versions

Description The issue allows remote attackers to execute arbitrary SQL commands via the id parameter in the makale.php file, a module for XOOPS.

Recommendations For Makale version 0.26, update the module to prevent SQL injection attacks by properly sanitizing the id parameter. For other possibly affected versions, ensure that the id parameter is validated and sanitized to prevent arbitrary SQL command execution.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-4653

Produtos afetados

Makale

Referências · 6

• 🔥 http://securityfocus.com/bid/31834 · Exploit
• 🔥 https://exploit-db.com/exploits/6795 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4653 · Nota de Segurança
• http://secunia.com/advisories/32347 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45991 · Nota
• http://securityreason.com/securityalert/4459 · Nota