PT-2009-3752 · Auth2Db · Auth2Db

Steffen Joeris · Publicado 2009-04-01 · Atualizado 2017-08-17 · CVE-2009-1208

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions auth2db versions 0.2.5 through 0.2.6

Description The issue allows remote attackers to conduct SQL injection attacks using multibyte character encodings due to the use of the addslashes function instead of the mysql real escape string function.

Recommendations For versions 0.2.5 through 0.2.6, update to version 0.2.7 or later to resolve the issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-1208

DSA-1757-1

Produtos afetados

Auth2Db

Referências · 7

• http://secunia.com/advisories/34488 · Aviso do Fabricante
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521823 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49518 · Nota
• http://securityfocus.com/bid/34287 · Nota
• http://debian.org/security/2009/dsa-1757 · Correção, Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1208 · Nota de Segurança
• http://auth2db.com.ar/?title=CHANGELOG · Nota