PT-2009-5145 · Arab Portal · Arab Portal

Recruit · Publicado 2009-08-17 · Atualizado 2017-09-19 · CVE-2009-2781

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Arab Portal versions 2.x

Description The issue allows remote authenticated users to execute arbitrary SQL commands via the qc parameter in an "addcomment" action in the forum.php file, but only when magic quotes gpc is disabled.

Recommendations For Arab Portal version 2.x, consider disabling the addcomment action in the forum.php file until a patch is available, or ensure that magic quotes gpc is enabled to prevent exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-2781

Produtos afetados

Arab Portal

Referências · 5

• 🔥 http://securityfocus.com/bid/35914 · Exploit
• 🔥 http://exploit-db.com/exploits/9320 · Exploit
• 🔥 https://exploit-db.com/exploits/9320 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2781 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2781 · Nota de Segurança