PT-2012-4354 · Viscacha · Viscacha

Publicado 2012-05-21 · Atualizado 2017-08-29 · CVE-2012-2908

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Viscacha version 0.8.1.1

Description The issue concerns SQL injection vulnerabilities in the admin/bbcodes.php file. Remote attackers can execute arbitrary SQL commands by manipulating certain parameters. The vulnerable parameters are bbcodeexample, buttonimage, and bbcodetag.

Recommendations For Viscacha version 0.8.1.1, consider restricting access to the admin/bbcodes.php file until a fix is available, and avoid using the bbcodeexample, buttonimage, and bbcodetag parameters in the affected API endpoint to minimize the risk of exploitation.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2012-2908

Produtos afetados

Viscacha

Referências · 7

• 🔥 http://vulnerability-lab.com/get_content.php?id=525 · Exploit
• 🔥 http://exploit-db.com/exploits/18873 · Exploit
• 🔥 http://securityfocus.com/bid/53496 · Exploit
• 🔥 https://exploit-db.com/exploits/18873 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2908 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2908 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75575 · Nota