PT-2012-5569 · Zeroboard · Siche Search Module

Snup · Publicado 2012-08-31 · Atualizado 2017-08-29 · CVE-2012-4743

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Siche search module version 0.5 for Zeroboard

Description The issue concerns SQL injection vulnerabilities in the ssearch.php file of the Siche search module. Remote attackers can execute arbitrary SQL commands by manipulating certain parameters. The vulnerable parameters include ss, sm, align, and category.

Recommendations For Siche search module version 0.5, consider restricting access to the ssearch.php file until a patch is available, and avoid using the ss, sm, align, and category parameters in the affected API endpoint. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2012-4743

Produtos afetados

Siche Search Module

Referências · 6

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-04/0099.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-4743 · Nota de Segurança
• http://vulnerability-lab.com/get_content.php?id=504 · Nota
• http://osvdb.org/81178 · Nota
• http://securityfocus.com/bid/53035 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74916 · Nota