PT-2010-3841 · Bf · Bf Survey Basic+3

Publicado 2010-06-09 · Atualizado 2010-06-10 · CVE-2010-2255

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BF Survey Pro versions prior to 1.3.1 BF Survey Pro Free version 1.2.6 BF Survey Basic versions prior to 1.2

Description The issue allows remote attackers to execute arbitrary SQL commands via the catid parameter to "index.php". This can lead to unauthorized access and manipulation of database content.

Recommendations For BF Survey Pro versions prior to 1.3.1, update to version 1.3.1 or later. For BF Survey Pro Free version 1.2.6, consider disabling the catid parameter in the "index.php" endpoint until a patch is available. For BF Survey Basic versions prior to 1.2, update to version 1.2 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2010-2255

Produtos afetados

Bf Survey Basic

Bf Survey Pro

Bf Survey Pro Free

Index.Php

Referências · 7

• 🔥 http://packetstormsecurity.org/1001-exploits/joomlabfsurveypro-sql.txt · Exploit
• 🔥 http://tamlyncreative.com.au/software/forum/index.php?topic=641.0 · Exploit
• 🔥 http://securityfocus.com/bid/37585 · Exploit
• 🔥 https://exploit-db.com/exploits/10944 · Exploit
• http://secunia.com/advisories/37868 · Aviso do Fabricante
• http://osvdb.org/61456 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2255 · Nota de Segurança