PT-2009-6033 · Dedecms · Dedecms

Publicado 2009-10-27 · Atualizado 2018-10-10 · CVE-2009-3806

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.1

Description A SQL injection issue exists, allowing remote attackers to execute arbitrary SQL commands. This is achieved via the arcurl parameter in the feedback js.php file.

Recommendations For DedeCMS version 5.1, avoid using the arcurl parameter in the feedback js.php file until a patch is available. As a temporary workaround, consider restricting access to the feedback js.php file to minimize the risk of exploitation.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-3806

Produtos afetados

Dedecms

Referências · 4

• 🔥 https://exploit-db.com/exploits/9876 · Exploit
• http://securityfocus.com/archive/1/507109/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3806 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3806 · Nota de Segurança