PT-2009-1434 · Unknown · Active Test

R3D-D3V!L · Publicado 2009-01-23 · Atualizado 2017-09-29 · CVE-2008-5959

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Active Test version 2.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the useremail parameter (also known as the username field) or the password parameter (also known as the password field) in the start.asp file.

Recommendations For Active Test version 2.1, consider restricting access to the start.asp file until a fix is available. As a temporary workaround, avoid using the useremail and password parameters in the start.asp file to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-5959

Produtos afetados

Active Test

Referências · 5

• 🔥 https://exploit-db.com/exploits/7276 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5959 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46921 · Nota
• http://osvdb.org/50408 · Nota
• http://secunia.com/advisories/32902 · Aviso do Fabricante