PT-2009-4139 · Easy Scripts · Easy Scripts Answer/Question Script

Cyb3R-1St · Publicado 2009-05-16 · Atualizado 2017-09-29 · CVE-2009-1655

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Easy Scripts Answer and Question Script (affected versions not specified)

Description: The issue concerns SQL injection vulnerabilities in the myaccount.php file. These vulnerabilities allow remote authenticated users to execute arbitrary SQL commands. The vulnerabilities can be exploited via the userid parameter and the password.

Recommendations: For all affected versions, consider restricting access to the myaccount.php file until a patch is available. As a temporary workaround, avoid using the userid parameter in the affected file to minimize the risk of exploitation. Additionally, restrict the use of password inputs in myaccount.php to reduce the risk of SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-1655

Produtos afetados

Easy Scripts Answer/Question Script

Referências · 5

• 🔥 https://exploit-db.com/exploits/8690 · Exploit
• 🔥 http://securityfocus.com/bid/34975 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1655 · Nota de Segurança
• http://secunia.com/advisories/35067 · Aviso do Fabricante
• http://osvdb.org/54502 · Nota