PT-2009-5383 · Phpbb · Phpbb

Primehalo

·

Publicado

2009-09-03

·

Atualizado

2017-09-19

·

CVE-2009-3052

CVSS v2.0

6.5

Média

VetorAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: phpBB 3 Prime Quick Style addon versions prior to 1.2.3
Description: The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the prime quick style parameter to the "/ucp.php" API endpoint.
Recommendations: For versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the /ucp.php endpoint or disabling the prime quick style parameter until a patch is available.

Exploit

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-3052

Produtos afetados

Phpbb