PT-2013-1984 · Wikidforum · Wikidforum

Henri Salo · Publicado 2013-01-24 · Atualizado 2017-08-29 · CVE-2012-6520

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Wikidforum version 2.10

Description The issue concerns SQL injection vulnerabilities in the advanced search functionality. Remote attackers can execute arbitrary SQL commands by manipulating the select sort or opt search select parameters.

Recommendations For Wikidforum version 2.10, as a temporary workaround, consider restricting access to the advanced search functionality until a patch is available. Avoid using the select sort and opt search select parameters in the affected search endpoint until the issue is resolved.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2012-6520

Produtos afetados

Wikidforum

Referências · 10

• 🔥 http://securityfocus.com/bid/52425 · Exploit
• 🔥 https://exploit-db.com/exploits/36946 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-03/0046.html · Exploit
• 🔥 http://darksecurity.de/advisories/2012/SSCHADV2012-005.txt · Exploit
• http://openwall.com/lists/oss-security/2012/04/15/1 · Nota
• http://openwall.com/lists/oss-security/2012/04/13/4 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73980 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6520 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6520 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/04/12/12 · Nota