PT-2009-4817 · Usolved · Newsolved

Lama · Publicado 2009-07-09 · Atualizado 2017-09-19 · CVE-2009-2389

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions USOLVED NEWSolved version 1.1.6

Description The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities in the newsscript.php file when magic quotes gpc is disabled. This can be achieved via the jahr or idneu parameter in an archive action, or the newsid parameter.

Recommendations For USOLVED NEWSolved version 1.1.6, consider disabling the archive action or restricting access to the newsscript.php file until a patch is available. Additionally, enabling magic quotes gpc can help mitigate the risk of SQL injection attacks. Avoid using the jahr, idneu, and newsid parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-2389

Produtos afetados

Newsolved

Referências · 4

• 🔥 http://exploit-db.com/exploits/9042 · Exploit
• 🔥 https://exploit-db.com/exploits/9042 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2389 · Nota de Segurança
• http://secunia.com/advisories/35611 · Aviso do Fabricante