PT-2009-5786 · Unknown · T-Htb Manager

Drosophila + 1 · Publicado 2009-09-30 · Atualizado 2018-10-10 · CVE-2009-3494

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions T-HTB Manager version 0.5

Description The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities in index.php. This is possible when magic quotes gpc is disabled, and attackers can exploit it via various parameters, including the id parameter in a delete category action and the name parameter in an update category action.

Recommendations For T-HTB Manager version 0.5, consider disabling the delete category and update category actions until a patch is available, and ensure magic quotes gpc is enabled to prevent SQL injection attacks. Restrict access to the index.php file to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-3494

Produtos afetados

T-Htb Manager

Referências · 5

• 🔥 http://exploit-db.com/exploits/9637 · Exploit
• 🔥 https://exploit-db.com/exploits/9637 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53145 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3494 · Nota de Segurança
• http://securityfocus.com/archive/1/506386/100/0/threaded · Nota