PT-2012-3028 · Adult Php Tube Script · Tube Ace

Daniel Godoy · Publicado 2012-02-08 · Atualizado 2017-08-29 · CVE-2012-1029

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tube Ace (Adult PHP Tube Script) version 1.6

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the q parameter in the "mobile/search/index.php" endpoint.

Recommendations For Tube Ace (Adult PHP Tube Script) version 1.6, avoid using the q parameter in the "mobile/search/index.php" endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the "mobile/search/index.php" endpoint to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2012-1029

Produtos afetados

Tube Ace

Referências · 10

• 🔥 https://exploit-db.com/exploits/36790 · Exploit
• 🔥 https://exploit-db.com/exploits/18466 · Exploit
• 🔥 http://securityfocus.com/bid/51873 · Exploit
• 🔥 http://exploit-db.com/exploits/18466 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72999 · Nota
• http://osvdb.org/78900 · Nota
• http://packetstormsecurity.org/files/109485/Tube-Ace-SQL-Injection.html · Nota
• http://securityfocus.com/bid/52046 · Nota
• http://secunia.com/advisories/47874 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-1029 · Nota de Segurança