PT-2009-4606 · Impleo · Impleo Music Collection

Sirgod · Publicado 2009-06-22 · Atualizado 2017-09-29 · CVE-2009-2154

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Impleo Music Collection version 2.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the username parameter in the "admin/login.php" endpoint, when magic quotes gpc is disabled.

Recommendations For Impleo Music Collection version 2.0, consider disabling the use of the username parameter in the "admin/login.php" endpoint until a patch is available, or enable magic quotes gpc to prevent SQL injection attacks.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-2154

Produtos afetados

Impleo Music Collection

Referências · 2

• 🔥 https://exploit-db.com/exploits/8947 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2154 · Nota de Segurança