PT-2009-4759 · Kervinet · Kervinet Forum

Elwaux · Publicado 2009-07-05 · Atualizado 2017-09-19 · CVE-2009-2328

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions KerviNet Forum versions 1.1 and earlier

Description The issue allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks. This is possible because the admin/edit user.php file does not require administrative authentication. The del user id parameter is vulnerable to such attacks.

Recommendations For KerviNet Forum versions 1.1 and earlier, consider restricting access to the admin/edit user.php file until a patch is available, and ensure that proper authentication mechanisms are in place to prevent unauthorized access. Avoid using the del user id parameter in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-2328

Produtos afetados

Kervinet Forum

Referências · 3

• 🔥 https://exploit-db.com/exploits/9068 · Exploit
• 🔥 http://exploit-db.com/exploits/9068 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2328 · Nota de Segurança