PT-2010-2373 · Evalsmsi · Evalsmsi

Publicado 2010-02-11 · Atualizado 2018-10-10 · CVE-2010-0616

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions evalSMSI version 2.1.03

Description The issue allows attackers with database access to gain privileges by leveraging stored passwords in cleartext. Remote attack vectors are possible by leveraging a separate SQL injection vulnerability.

Recommendations For evalSMSI version 2.1.03, consider updating the password storage mechanism to a more secure method, such as hashing and salting, to prevent unauthorized access. As a temporary workaround, restrict database access to minimize the risk of exploitation. Additionally, address the separate SQL injection vulnerability to prevent remote attacks.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2010-0616

Produtos afetados

Evalsmsi

Referências · 7

• 🔥 http://securityfocus.com/bid/38116 · Exploit
• 🔥 http://packetstormsecurity.org/1002-exploits/corelan-10-008-evalmsi.txt · Exploit
• http://secunia.com/advisories/38478 · Aviso do Fabricante
• http://osvdb.org/62180 · Nota
• http://corelan.be:8800/index.php/forum/security-advisories/corelan-10-008-evalmsi-2-1-03-multiple-vulnerabilities · Nota
• http://securityfocus.com/archive/1/509370/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0616 · Nota de Segurança