PT-2009-3787 · Cccp · Cccp Community Clan Portal Pastebin

Publicado 2009-04-06 · Atualizado 2017-08-17 · CVE-2009-1245

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CCCP Community Clan Portal Pastebin versions prior to 2.80

Description The issue concerns SQL injection vulnerabilities in the insert to pastebin function. Remote attackers can execute arbitrary SQL commands via the subject, language, and nickname parameters to the "php/cccp-pages/submit.php" endpoint.

Recommendations For versions prior to 2.80, update to version 2.80 or later to resolve the issue. As a temporary workaround, consider restricting access to the insert to pastebin function or the "php/cccp-pages/submit.php" endpoint until a patch is available. Avoid using the subject, language, and nickname parameters in the affected endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-1245

Produtos afetados

Cccp Community Clan Portal Pastebin

Referências · 6

• 🔥 http://jcsfog.cvs.sourceforge.net/viewvc/jcsfog/CCCP-Pastebin/php/cccp-admin/inc/functions.php?r1=1.10&r2=1.11 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49426 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1245 · Nota de Segurança
• http://secunia.com/advisories/34474 · Aviso do Fabricante
• http://sourceforge.net/project/shownotes.php?release_id=670960 · Nota
• http://securityfocus.com/bid/34264 · Nota