PT-2010-3253 · Taskfreak!+1 · Taskfreak!+1

Publicado 2010-05-05 · Atualizado 2017-08-17 · CVE-2010-1583

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tirzen Framework version 1.5 TaskFreak! versions prior to 0.6.3

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the username field in a login action, exploiting a SQL injection vulnerability in the loadByKey function in the TznDbConnection class in tzn mysql.php.

Recommendations For Tirzen Framework version 1.5, update to a version that fixes the SQL injection vulnerability in the loadByKey function. For TaskFreak! versions prior to 0.6.3, update to version 0.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the loadByKey function in the TznDbConnection class until a patch is available.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2010-1583

Produtos afetados

Taskfreak!

Tirzen Framework

Referências · 8

• 🔥 http://exploit-db.com/exploits/12452 · Exploit
• 🔥 https://exploit-db.com/exploits/12452 · Exploit
• http://securityfocus.com/bid/39793 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1583 · Nota
• http://taskfreak.com/versions.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1583 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58241 · Nota
• http://madirish.net/?article=456 · Nota