PT-2009-4739 · Punbb · Punbb+1

Dante90 + 1 · Publicado 2009-07-02 · Atualizado 2017-09-19 · CVE-2009-2308

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PunBB Affiliation module versions 1.1.0 and earlier

Description The issue concerns SQL injection vulnerabilities in the affiliates.php file of the Affiliation module for PunBB. Remote attackers can execute arbitrary SQL commands by manipulating the in or out parameters.

Recommendations For PunBB Affiliation module versions 1.1.0 and earlier, consider restricting access to the affiliates.php file until a patch is available. As a temporary workaround, avoid using the in and out parameters in the affected module to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-2308

Produtos afetados

Punbb

Punbb Affiliation Module

Referências · 8

• 🔥 https://exploit-db.com/exploits/9055 · Exploit
• 🔥 http://packetstormsecurity.org/0906-exploits/punbbaffiliations-blindsql.txt · Exploit
• 🔥 http://packetstormsecurity.org/0906-exploits/punbbaffiliationsin-blindsql.txt · Exploit
• 🔥 http://exploit-db.com/exploits/9055 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51437 · Nota
• http://osvdb.org/55478 · Nota
• http://secunia.com/advisories/35654 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-2308 · Nota de Segurança