PT-2010-1605 · Glfusion · Glfusion

Nine:Situations:Group · Publicado 2010-04-22 · Atualizado 2018-10-10 · CVE-2009-4796

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions glFusion versions 1.1.2 and earlier

Description The issue concerns SQL injection vulnerabilities in the ExecuteQueries function. Remote attackers can execute arbitrary SQL commands via the order and direction parameters to the "search.php" endpoint.

Recommendations For glFusion versions 1.1.2 and earlier, as a temporary workaround, consider restricting access to the ExecuteQueries function in listfactory.class.php until a patch is available. Avoid using the order and direction parameters in the search.php endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-4796

Produtos afetados

Glfusion

Referências · 10

• 🔥 https://exploit-db.com/exploits/8302 · Exploit
• 🔥 http://securityfocus.com/bid/34281 · Exploit
• 🔥 http://exploit-db.com/exploits/8302 · Exploit
• http://glfusion.org/article.php/security_20090329 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4796 · Nota
• http://secunia.com/advisories/34519 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49498 · Nota
• http://securityfocus.com/archive/1/502260/100/0/threaded · Nota
• http://osvdb.org/52984 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4796 · Nota de Segurança