PT-2009-4213 · Dm · File Manager

Snakespc · Publicado 2009-05-20 · Atualizado 2017-09-29 · CVE-2009-1741

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: DM FileManager version 3.9.2

Description: The issue concerns SQL injection vulnerabilities in the login.php file of DM FileManager. When magic quotes gpc is disabled, remote attackers can execute arbitrary SQL commands by manipulating the Username and Password fields.

Recommendations: For DM FileManager version 3.9.2, consider disabling the login functionality in login.php until a patch is available, or enable magic quotes gpc to mitigate the risk of SQL injection attacks.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-1741

Produtos afetados

File Manager

Referências · 5

• 🔥 http://securityfocus.com/bid/35035 · Exploit
• 🔥 https://exploit-db.com/exploits/8741 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1741 · Nota de Segurança
• http://osvdb.org/54597 · Nota
• http://secunia.com/advisories/35167 · Aviso do Fabricante