PT-2010-4350 · Unknown · Event Horizon

Publicado 2010-07-23 · Atualizado 2010-07-29 · CVE-2010-2855

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Event Horizon (EVH) version 1.1.10

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in the modfile.php file, specifically when the magic quotes gpc setting is disabled. The vulnerable parameters are YourEmail and VerificationNumber.

Recommendations For Event Horizon (EVH) version 1.1.10, consider disabling the modfile.php file or restricting access to it until a fix is available. As a temporary workaround, enable the magic quotes gpc setting to prevent SQL injection attacks via the YourEmail and VerificationNumber parameters.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2010-2855

Produtos afetados

Event Horizon

Referências · 3

• http://securityfocus.com/bid/41580 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2855 · Nota de Segurança
• http://secunia.com/advisories/40517 · Aviso do Fabricante