PT-2009-3287 · 4Site · 4Site Cms

D.Mortalov

·

Publicado

2009-02-18

·

Atualizado

2018-10-10

·

CVE-2009-0646

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions 4Site CMS versions 2.6 and earlier
Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including login and password to the "pcgi/4site.pl" endpoint, page to "print/print.shtml", s and i to "portfolio/index.shtml", h to "hotel/index.php", id to "news/news1.shtml", and th to "faq/index.shtml".
Recommendations For 4Site CMS versions 2.6 and earlier, update to a version later than 2.6 to resolve the issue. As a temporary workaround, consider restricting access to the affected endpoints, such as "pcgi/4site.pl", "print/print.shtml", "portfolio/index.shtml", "hotel/index.php", "news/news1.shtml", and "faq/index.shtml", until a patch is available. Avoid using the vulnerable parameters login, password, page, s, i, h, id, and th in the respective endpoints until the issue is resolved.

Exploit

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-0646

Produtos afetados

4Site Cms