PT-2009-5643 · Php · Phpprobid

Noge · Publicado 2009-09-24 · Atualizado 2017-09-19 · CVE-2009-3336

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP Pro Bid (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary SQL commands via the auction id parameter in the auction details.php file. This can lead to unauthorized access and manipulation of database content.

Recommendations For PHP Pro Bid, consider validating and sanitizing the auction id parameter to prevent SQL injection attacks. As a temporary workaround, restrict access to the auction details.php file until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-3336

Produtos afetados

Phpprobid

Referências · 5

• 🔥 http://exploit-db.com/exploits/9665 · Exploit
• 🔥 https://exploit-db.com/exploits/9665 · Exploit
• 🔥 http://securityfocus.com/bid/36389 · Exploit
• http://vupen.com/english/advisories/2009/2661 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-3336 · Nota de Segurança