PT-2009-4100 · Leap · Leap Cms

Yenh4Cker · Publicado 2009-05-11 · Atualizado 2017-09-29 · CVE-2009-1613

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Leap CMS version 0.1.4

Description: The issue concerns SQL injection vulnerabilities in the leap.php file of Leap CMS. When the magic quotes gpc setting is disabled, remote attackers can execute arbitrary SQL commands. This is possible via the searchterm or email parameters.

Recommendations: For Leap CMS version 0.1.4, consider disabling the leap.php file or restricting access to it until a patch is available. As a temporary workaround, enable the magic quotes gpc setting to prevent SQL injection attacks. Avoid using the searchterm and email parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-1613

Produtos afetados

Leap Cms

Referências · 4

• 🔥 https://exploit-db.com/exploits/8576 · Exploit
• 🔥 https://exploit-db.com/exploits/8577 · Exploit
• http://secunia.com/advisories/34943 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1613 · Nota de Segurança