PT-2008-6551 · Punbb · Punbb

Phplizardo · Publicado 2008-12-11 · Atualizado 2017-08-08 · CVE-2008-5434

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PunBB versions 1.3 through 1.3.1

Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This can be achieved via the order by or direction parameter to "admin/users.php", or through configuration options to "admin/settings.php".

Recommendations For PunBB versions 1.3 through 1.3.1, consider restricting access to the admin/users.php and admin/settings.php pages until a fix is available. As a temporary workaround, avoid using the order by and direction parameters in the admin/users.php page, and limit modifications to configuration options in admin/settings.php.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-5434

Produtos afetados

Punbb

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2008-5434 · Nota de Segurança
• http://punbb.informer.com/forums/topic/20475/punbb-132 · Nota
• http://openwall.com/lists/oss-security/2008/12/09/3 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47185 · Nota
• http://punbb.informer.com · Aviso do Fabricante
• http://punbb.informer.com/wiki/punbb13/bugs#potential_sql-injections_in_adminsettings.php_via_configuration_values · Aviso do Fabricante
• http://secunia.com/advisories/33059 · Nota
• http://punbb.informer.com/wiki/punbb13/bugs#potential_sql-injections_at_adminusers.php_page · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5434 · Nota