PT-2009-5283 · Piwigo · Piwigo

CVE-2009-2933 · Publicado 2009-08-21 · Atualizado 2024-02-14

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Piwigo versions prior to 2.0.3

Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the items number parameter in the comments.php file.

Recommendations: For versions prior to 2.0.3, update to version 2.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the comments.php file or avoiding the use of the items number parameter until the update is applied.

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-2933

Produtos afetados

Piwigo

Referências · 5

• http://senseofsecurity.com.au/advisories/SOS-09-007.pdf · Nota
• http://securityfocus.com/archive/1/505801/100/0/threaded · Nota
• http://secunia.com/advisories/36333 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-2933 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2933 · Nota