PT-2010-1484 · Mole · Mole Group Sky Hunter Bus Ticket Script+1

G4N0K · Publicado 2010-03-05 · Atualizado 2017-09-19 · CVE-2009-4674

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script (affected versions not specified)

Description The issue allows remote attackers to change an arbitrary password by modifying the user id field in the admin/admin.php script.

Recommendations For Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script, restrict access to the admin/admin.php script to minimize the risk of exploitation. Avoid using the user id field in the affected script until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2009-4674

Produtos afetados

Mole Group Sky Hunter Airline Ticket Sale Script

Mole Group Sky Hunter Bus Ticket Script

Referências · 5

• 🔥 http://exploit-db.com/exploits/8774 · Exploit
• 🔥 https://exploit-db.com/exploits/8774 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50722 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4674 · Nota de Segurança
• http://securityfocus.com/bid/35079 · Nota