PT-2013-4467 · Todoo · Todoo Forum

Publicado 2013-05-13 · Atualizado 2017-08-29 · CVE-2013-3537

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Todoo Forum version 2.0

Description The issue concerns SQL injection vulnerabilities in the todooforum.php file. Remote attackers can execute arbitrary SQL commands by manipulating the id post or pg parameters.

Recommendations For Todoo Forum version 2.0, update the todooforum.php file to properly sanitize the id post and pg parameters to prevent SQL injection attacks. As a temporary workaround, consider restricting access to the todooforum.php file until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2013-3537

Produtos afetados

Todoo Forum

Referências · 6

• 🔥 http://packetstormsecurity.com/files/121290/Todoo-Forum-2.0-Cross-Site-Scripting-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/38477 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/83599 · Nota
• http://securityfocus.com/bid/59069 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3537 · Nota de Segurança
• http://osvdb.org/92318 · Nota