PT-2009-4616 · Kjtechforce · Kjtechforce Mailman

Yenh4Cker · Publicado 2009-06-22 · Atualizado 2018-10-10 · CVE-2009-2164

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Kjtechforce mailman version beta1

Description The issue concerns SQL injection vulnerabilities. These occur when an application uses user input to construct SQL queries without proper validation, allowing attackers to inject malicious SQL code. In this case, the vulnerabilities are present in the Kjtechforce mailman beta1 version, specifically when the magic quotes gpc setting is disabled. This setting is used to automatically escape any special characters in user input, which can help prevent SQL injection attacks. With magic quotes gpc disabled, remote attackers can execute arbitrary SQL commands. This can be achieved through two specific API endpoints: "activate.php" by manipulating the code parameter, and "index.php" by manipulating the dest parameter.

Recommendations For Kjtechforce mailman version beta1, consider disabling the activate.php and index.php scripts until a patch is available, or ensure that the magic quotes gpc setting is enabled to mitigate the risk of SQL injection attacks. Additionally, restrict access to these scripts to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-2164

Produtos afetados

Kjtechforce Mailman

Referências · 4

• 🔥 https://exploit-db.com/exploits/8884 · Exploit
• 🔥 https://exploit-db.com/exploits/8885 · Exploit
• http://securityfocus.com/archive/1/504136/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2164 · Nota de Segurança