PT-2009-1710 · Unknown · Simple Document Management System

Publicado 2009-02-21 · Atualizado 2017-08-17 · CVE-2008-6236

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Simple Document Management System (SDMS) versions 1.1.4 through 1.1.5 Simple Document Management System (SDMS) versions prior to 1.1.4

Description: The issue allows remote attackers to execute arbitrary SQL commands via the login parameter in the login.php file. This can be exploited by sending malicious input to the login endpoint.

Recommendations: For Simple Document Management System (SDMS) versions 1.1.4 through 1.1.5, consider restricting access to the login.php file until a fix is available. For Simple Document Management System (SDMS) versions prior to 1.1.4, consider upgrading to a version that is known to be secure, or restricting access to the login.php file. As a temporary workaround, consider validating and sanitizing the login parameter to prevent malicious input.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-6236

Produtos afetados

Simple Document Management System

Referências · 6

• 🔥 http://securityfocus.com/bid/32114 · Exploit
• 🔥 https://exploit-db.com/exploits/6987 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48944 · Nota
• http://secunia.com/advisories/32502 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46342 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-6236 · Nota de Segurança