PT-2009-1324 · Constructr · Constructr Cms

Fuzion · Publicado 2009-01-05 · Atualizado 2017-09-29 · CVE-2008-5847

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Constructr CMS versions 3.02.5 and earlier

Description The issue allows context-dependent attackers to obtain sensitive information by reading the hash column in a MySQL database, as passwords are stored in cleartext.

Recommendations For Constructr CMS versions 3.02.5 and earlier, consider updating the password storage mechanism to hash and salt passwords, and restrict access to the MySQL database to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2008-5847

Produtos afetados

Constructr Cms

Referências · 4

• 🔥 https://exploit-db.com/exploits/7529 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5847 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5847 · Nota de Segurança
• http://securityreason.com/securityalert/4868 · Nota