PT-2009-2111 · Shader Tv · Shader Tv

U238 + 1 · Publicado 2009-04-07 · Atualizado 2017-09-29 · CVE-2008-6641

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Shader TV (Beta) (affected versions not specified)

Description The issue allows remote authenticated administrators to execute arbitrary SQL commands via the sid parameter to API endpoints such as "kanal.asp", "google.asp", and "hakk.asp" in the "yonet/" directory. Additionally, remote attackers can execute arbitrary SQL commands via the username or password fields to the "yonet/default.asp" endpoint.

Recommendations For Shader TV (Beta), as a temporary workaround, consider restricting access to the "yonet/" directory and its contents, such as "kanal.asp", "google.asp", "hakk.asp", and "default.asp", to minimize the risk of exploitation. Avoid using the sid parameter in the affected API endpoints until the issue is resolved. Also, restrict the use of the username and password fields in the "yonet/default.asp" endpoint to prevent arbitrary SQL command execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-6641

Produtos afetados

Shader Tv

Referências · 4

• 🔥 https://exploit-db.com/exploits/5564 · Exploit
• 🔥 http://securityfocus.com/bid/29091 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42261 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-6641 · Nota de Segurança