PT-2009-2218 · Flexphpdirectory · Flexphpdirectory

X0R · Publicado 2009-04-24 · Atualizado 2017-09-29 · CVE-2008-6749

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: FlexPHPDirectory version 0.0.1

Description: The issue concerns SQL injection vulnerabilities in the admin/usercheck.php file. When magic quotes gpc is disabled, remote attackers can execute arbitrary SQL commands via the checkuser and checkpass parameters in the /admin/usercheck.php API endpoint.

Recommendations: For FlexPHPDirectory version 0.0.1, consider disabling the checkuser and checkpass parameters in the admin/usercheck.php file until a patch is available. Restrict access to the admin/usercheck.php endpoint to minimize the risk of exploitation. Avoid using the checkuser and checkpass parameters in this endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-6749

Produtos afetados

Flexphpdirectory

Referências · 5

• 🔥 https://exploit-db.com/exploits/7614 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6749 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47640 · Nota
• http://secunia.com/advisories/33353 · Aviso do Fabricante
• http://osvdb.org/51302 · Nota