PT-2008-5976 · Oscommerce · Oscommerce Poll Booth Add-On

S@Bun · Publicado 2008-10-28 · Atualizado 2017-09-29 · CVE-2008-4765

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions osCommerce Poll Booth Add-On version 2.0

Description The issue concerns a SQL injection vulnerability. It allows remote attackers to execute arbitrary SQL commands via the pollID parameter in a results operation.

Recommendations For osCommerce Poll Booth Add-On version 2.0, consider restricting access to the pollID parameter in the results operation to minimize the risk of exploitation. Avoid using the pollID parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-4765

Produtos afetados

Oscommerce Poll Booth Add-On

Referências · 6

• 🔥 http://packetstormsecurity.org/0804-exploits/pollbooth20-sql.txt · Exploit
• 🔥 https://exploit-db.com/exploits/5436 · Exploit
• 🔥 http://securityfocus.com/bid/28752 · Exploit
• 🔥 https://exploit-db.com/exploits/31640 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4765 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41796 · Nota