PT-2009-5276 · Php · Php Competition System

Mr.Sql · Publicado 2009-08-21 · Atualizado 2017-09-19 · CVE-2009-2926

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHP Competition System versions BETA 0.84 and earlier

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the day parameter to "show matchs.php" and the pageno parameter to "persons.php".

Recommendations: For PHP Competition System versions BETA 0.84 and earlier, consider updating to a newer version that addresses the SQL injection vulnerabilities. As a temporary workaround, restrict access to the "show matchs.php" and "persons.php" scripts to minimize the risk of exploitation. Avoid using the day and pageno parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-2926

Produtos afetados

Php Competition System

Referências · 4

• 🔥 https://exploit-db.com/exploits/9438 · Exploit
• 🔥 http://exploit-db.com/exploits/9438 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52487 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2926 · Nota de Segurança