PT-2009-1448 · Unknown · Active Web Mail

R3D-D3V!L · Publicado 2009-01-27 · Atualizado 2017-09-29 · CVE-2008-5973

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Active Web Mail version 4.0

Description The issue allows remote attackers to execute arbitrary SQL commands via the password parameter in the "login.aspx" page.

Recommendations For Active Web Mail version 4.0, consider restricting access to the login.aspx page until a patch is available, and avoid using the password parameter in this context to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-5973

Produtos afetados

Active Web Mail

Referências · 4

• 🔥 https://exploit-db.com/exploits/7281 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5973 · Nota de Segurança
• http://secunia.com/advisories/32921 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46915 · Nota