PT-2009-2376 · Gigs · Gigs

Staker · Publicado 2009-08-06 · Atualizado 2017-09-29 · CVE-2008-6907

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: 2532|Gigs version 1.2.2

Description: The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities in the checkuser.php file. This occurs when magic quotes gpc is disabled, and attackers can exploit the username and password parameters, which are accessible from a form generated by index.php.

Recommendations: For version 1.2.2, consider disabling the checkuser.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent SQL injection attacks. Avoid using the username and password parameters in the affected form until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-6907

Produtos afetados

Gigs

Referências · 5

• 🔥 http://securityfocus.com/bid/32913 · Exploit
• 🔥 https://exploit-db.com/exploits/7511 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6907 · Nota de Segurança
• http://secunia.com/advisories/26585 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47491 · Nota