PT-2009-1839 · Ad Server Solutions · Ad Server Solutions Affiliate

R3D-D3V!L · Publicado 2009-03-02 · Atualizado 2017-09-29 · CVE-2008-6366

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Ad Server Solutions Affiliate Software Java version 4.0

Description: The issue allows remote attackers to execute arbitrary SQL commands, possibly related to the uname and pass parameters to "logon process.jsp". This is achieved via the username and password in "logon.jsp".

Recommendations: For Ad Server Solutions Affiliate Software Java version 4.0, consider restricting access to the "logon.jsp" and "logon process.jsp" pages until a fix is available, and avoid using the uname and pass parameters in the "logon process.jsp" endpoint to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-6366

Produtos afetados

Ad Server Solutions Affiliate

Referências · 7

• 🔥 http://packetstorm.linuxsecurity.com/0812-exploits/affiliatesj-sql.txt · Exploit
• 🔥 http://securityfocus.com/bid/32791 · Exploit
• 🔥 https://exploit-db.com/exploits/32655 · Exploit
• 🔥 https://exploit-db.com/exploits/7423 · Exploit
• http://secunia.com/advisories/33072 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-6366 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47280 · Nota