PT-2011-1943 · Brightsuite · Brightsuite Groupware

L0Rd Crusad3R · Publicado 2011-11-02 · Atualizado 2012-02-14 · CVE-2010-5008

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BrightSuite Groupware version 5.4

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. The issue is exploited via the ContactID parameter in the "pages/contact list mail form.asp" page.

Recommendations For BrightSuite Groupware version 5.4, update the software to a version that fixes this issue, or as a temporary workaround, consider restricting access to the "pages/contact list mail form.asp" page to minimize the risk of exploitation. Avoid using the ContactID parameter in the affected page until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2010-5008

Produtos afetados

Brightsuite Groupware

Referências · 7

• 🔥 http://packetstormsecurity.org/1006-exploits/brightsuite-sql.txt · Exploit
• 🔥 http://exploit-db.com/exploits/13843 · Exploit
• 🔥 https://exploit-db.com/exploits/13843 · Exploit
• 🔥 http://securityfocus.com/bid/40845 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-5008 · Nota de Segurança
• http://vupen.com/english/advisories/2010/1459 · Aviso do Fabricante
• http://securityreason.com/securityalert/8507 · Nota