PT-2009-3349 · Mambo Joomla · Gigcalendar

Publicado 2009-02-24 · Atualizado 2018-10-10 · CVE-2009-0730

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GigCalendar (com gigcal) component version 1.0 for Mambo and Joomla!

Description The issue allows remote attackers to execute arbitrary SQL commands when magic quotes gpc is disabled. This is possible via the gigcal venues id parameter in a details action to "index.php", which is not properly handled by venuedetails.php, and the gigcal bands id parameter in a details action to "index.php", which is not properly handled by banddetails.php.

Recommendations For GigCalendar (com gigcal) component version 1.0, consider disabling the parameters gigcal venues id and gigcal bands id in the affected API endpoints until a patch is available. Restrict access to the venuedetails.php and banddetails.php files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-0730

Produtos afetados

Gigcalendar

Referências · 9

• 🔥 https://exploit-db.com/exploits/32807 · Exploit
• 🔥 http://securityfocus.com/bid/33863 · Exploit
• 🔥 https://exploit-db.com/exploits/7815 · Exploit
• 🔥 http://securityfocus.com/bid/33859 · Exploit
• http://securityfocus.com/archive/1/501175/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48865 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0730 · Nota de Segurança
• http://securityfocus.com/archive/1/501176/100/0/threaded · Nota
• http://securityfocus.com/archive/1/501174/100/0/threaded · Nota