PT-2011-1056 · Gilles Lamiral · Domain Technologie Control
Ansgar Burchardt
·
Publicado
2011-03-07
·
Atualizado
2017-08-17
·
CVE-2011-0434
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Domain Technologie Control (DTC) versions prior to 0.32.9
Description
The issue concerns multiple SQL injection vulnerabilities that can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, the
cid parameter in certain API endpoints, such as /admin/bw per month.php and /client/bw per month.php, is vulnerable to SQL injection attacks, allowing remote attackers to execute arbitrary SQL commands.Recommendations
For versions prior to 0.32.9, update to version 0.32.9 or later to resolve the issue.
As a temporary workaround, consider restricting access to the vulnerable API endpoints
/admin/bw per month.php and /client/bw per month.php until a patch is applied.
Avoid using the cid parameter in the affected API endpoints until the issue is resolved.Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Domain Technologie Control