PT-2009-5005 · Traidnt · Traidnt Up

Qabandi · Publicado 2009-07-27 · Atualizado 2017-09-19 · CVE-2009-2605

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Traidnt Up version 2.0

Description The issue concerns SQL injection vulnerabilities in the adminquery.php file. Remote attackers can execute arbitrary SQL commands by manipulating the trupuser and truppassword cookies to access the uploadcp/index.php endpoint.

Recommendations For Traidnt Up version 2.0, consider restricting access to the adminquery.php file and the uploadcp/index.php endpoint until a fix is available. As a temporary workaround, avoid using the trupuser and truppassword cookies in the affected endpoint to minimize the risk of exploitation.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-2605

Produtos afetados

Traidnt Up

Referências · 7

• 🔥 http://exploit-db.com/exploits/8831 · Exploit
• 🔥 https://exploit-db.com/exploits/8831 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2605 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2605 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50866 · Nota
• http://osvdb.org/54809 · Nota
• http://secunia.com/advisories/35273 · Aviso do Fabricante