PT-2010-2675 · Nonecms · Nonecms

:[Melkiy]: + 1 · Publicado 2010-03-09 · Atualizado 2017-08-17 · CVE-2010-0952

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OneCMS version 2.5

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible when the magic quotes gpc setting is disabled. The vulnerability can be exploited via the user parameter in an elite action in the index.php file.

Recommendations For OneCMS version 2.5, consider enabling the magic quotes gpc setting to prevent SQL injection attacks. As a temporary workaround, restrict access to the index.php file or avoid using the user parameter in elite actions until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2010-0952

Produtos afetados

Nonecms

Referências · 7

• 🔥 http://exploit-db.com/exploits/11635 · Exploit
• 🔥 http://securityfocus.com/bid/38557 · Exploit
• 🔥 https://exploit-db.com/exploits/11635 · Exploit
• 🔥 http://packetstormsecurity.org/1003-exploits/onecmsv25-sql.txt · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56700 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0952 · Nota de Segurança
• http://secunia.com/advisories/30378 · Aviso do Fabricante