PT-2013-4457 · Vanilla · Vanilla Forums

Bl4Ckw0Rm

·

Publicado

2013-05-10

·

Atualizado

2020-06-04

·

CVE-2013-3527

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Vanilla Forums versions prior to 2.0.18.8
Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the name parameter in the Form/Email array to either the "entry/signin" or "entry/passwordrequest" API endpoints.
Recommendations For versions prior to 2.0.18.8, update to version 2.0.18.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the "entry/signin" and "entry/passwordrequest" endpoints until the update is applied. Avoid using the name parameter in these endpoints until the issue is resolved.

Exploit

Correção

RCE

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2013-3527

Produtos afetados

Vanilla Forums