PT-2009-2078 · Develop It Easy · Developiteasy Events Calendar

Cyb3R-1St · Publicado 2009-04-06 · Atualizado 2017-09-29 · CVE-2008-6608

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DevelopItEasy Events Calendar version 1.2

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the "user name" parameter to "admin/index.php", the "user pass" parameter to "admin/index.php", or the id parameter to "calendar details.php".

Recommendations For DevelopItEasy Events Calendar version 1.2, consider restricting access to the vulnerable parameters user name and user pass in the "admin/index.php" endpoint, as well as the id parameter in the "calendar details.php" endpoint, until a fix is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-6608

Produtos afetados

Developiteasy Events Calendar

Referências · 7

• 🔥 https://exploit-db.com/exploits/7013 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46395 · Nota
• http://securityfocus.com/bid/32148 · Nota
• http://osvdb.org/49756 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-6608 · Nota de Segurança
• http://secunia.com/advisories/32596 · Aviso do Fabricante
• http://osvdb.org/49755 · Nota