PT-2011-1758 · 6Kbbs · 6Kbbs

Zym · Publicado 2011-07-08 · Atualizado 2017-08-29 · CVE-2010-4812

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 6kbbs version 8.0 build 20100901

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the tids[] parameter to "ajaxadmin.php" and the msgids[] parameter to "ajaxmember.php".

Recommendations For version 8.0 build 20100901, consider restricting access to the "ajaxadmin.php" and "ajaxmember.php" API endpoints until a patch is available. As a temporary workaround, avoid using the tids[] and msgids[] parameters in the affected API endpoints.

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2010-4812

Produtos afetados

6Kbbs

Referências · 7

• http://bbs.wolvez.org/viewtopic.php?id=180 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4812 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/63286 · Nota
• http://6kbbs.net/view-487.html · Correção
• http://secunia.com/advisories/42204 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4812 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/63285 · Nota