PT-2009-4776 · Clansphere · Clansphere

Hajo · Publicado 2009-07-07 · Atualizado 2009-07-08 · CVE-2009-2345

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ClanSphere versions prior to 2009.0.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via unknown parameters to the gbook module and unspecified other components.

Recommendations For versions prior to 2009.0.1, update to version 2009.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the gbook module and other vulnerable components to minimize the risk of exploitation.

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-2345

Produtos afetados

Clansphere

Referências · 6

• http://vupen.com/english/advisories/2009/1794 · Aviso do Fabricante
• http://securityfocus.com/bid/35576 · Correção
• http://clansphere.net/index/news/view/id/405 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2345 · Nota
• http://secunia.com/advisories/35694 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-2345 · Nota de Segurança