PT-2008-5968 · Php · Php-Daily

0Xffffff · Publicado 2008-10-28 · Atualizado 2017-09-29 · CVE-2008-4757

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Daily (affected versions not specified)

Description The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This is achieved through the id parameter in scripts such as add postit.php, delete.php, and mod prest date.php, and the prev parameter in prest detail.php. No information is provided about the estimated number of potentially affected devices or real-world incidents.

Recommendations For PHP-Daily, consider restricting access to the add postit.php, delete.php, mod prest date.php, and prest detail.php scripts until a fix is available. As a temporary workaround, avoid using the id and prev parameters in the affected scripts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-4757

Produtos afetados

Php-Daily

Referências · 4

• 🔥 https://exploit-db.com/exploits/6833 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46125 · Nota
• http://securityfocus.com/bid/31915 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4757 · Nota de Segurança