PT-2010-1646 · Basic Analysis Security Engine · Base

Publicado 2010-05-05 · Atualizado 2012-07-03 · CVE-2009-4838

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Basic Analysis and Security Engine (BASE) versions prior to 1.4.3.1

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. The issue is related to the base ag common.php file and involves unspecified parameters.

Recommendations For versions prior to 1.4.3.1, update to version 1.4.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the base ag common.php file to minimize the risk of exploitation. Avoid using unspecified parameters in the affected file until the issue is resolved.

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-4838

Produtos afetados

Base

Referências · 5

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4838 · Nota
• http://secunia.com/advisories/35222 · Aviso do Fabricante
• http://base.secureideas.net/news.php · Nota
• http://secureideas.cvs.sourceforge.net/viewvc/secureideas/base-php4/base_ag_common.php?sortby=date&view · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4838 · Nota de Segurança