PT-2010-1785 · Irokez · Irokez Cms

Ins3T · Publicado 2010-08-25 · Atualizado 2017-09-19 · CVE-2009-4982

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Irokez CMS version 0.7.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible due to a SQL injection vulnerability in the select function when magic quotes gpc is disabled. The vulnerability can be exploited via the PATH INFO to the default URI.

Recommendations For Irokez CMS version 0.7.1, consider disabling the select function or restricting access to it until a patch is available. Additionally, enabling magic quotes gpc can help mitigate the risk of SQL injection attacks.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-4982

Produtos afetados

Irokez Cms

Referências · 6

• 🔥 http://securityfocus.com/bid/35957 · Exploit
• 🔥 https://exploit-db.com/exploits/9369 · Exploit
• 🔥 http://exploit-db.com/exploits/9369 · Exploit
• http://secunia.com/advisories/23497 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/2167 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-4982 · Nota de Segurança