PT-2012-5266 · Jcore · Jcore

Publicado 2012-10-22 · Atualizado 2017-08-29 · CVE-2012-4232

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions jCore versions prior to 1.0pre2

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the memberloginid cookie in the admin/index.php file.

Recommendations For versions prior to 1.0pre2, update to version 1.0pre2 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin/index.php file to minimize the risk of exploitation. Avoid using the memberloginid cookie in the affected file until the issue is resolved.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2012-4232

Produtos afetados

Jcore

Referências · 7

• 🔥 https://htbridge.com/advisory/HTB23107 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-10/0097.html · Exploit
• 🔥 http://securityfocus.com/bid/56102 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4232 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79442 · Nota
• http://jcore.net/news/jcore-ver-10pre2-available-for-testing · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-4232 · Nota de Segurança