PT-2009-5542 · Almondsoft · Almond Affiliate Network Classifieds+1

Publicado 2009-09-16 · Atualizado 2009-09-17 · CVE-2009-3226

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlmondSoft Almond Classifieds Ads Enterprise (affected versions not specified) Almond Affiliate Network Classifieds (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the replid parameter in a "manw repl add form" action in the index.php file.

Recommendations For AlmondSoft Almond Classifieds Ads Enterprise, avoid using the replid parameter in the "manw repl add form" action until the issue is resolved. For Almond Affiliate Network Classifieds, avoid using the replid parameter in the "manw repl add form" action until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-3226

Produtos afetados

Almond Affiliate Network Classifieds

Almond Classifieds Ads Enterprise

Referências · 5

• 🔥 http://securityfocus.com/bid/35816 · Exploit
• 🔥 https://exploit-db.com/exploits/33115 · Exploit
• 🔥 http://packetstormsecurity.org/0907-exploits/almondclassifiedsads-bsqlxss.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3226 · Nota de Segurança
• http://secunia.com/advisories/36003 · Aviso do Fabricante