PT-2014-5549 · Imember360 · Imember360

Publicado 2014-05-23 · Atualizado 2014-05-27 · CVE-2014-3848

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions iMember360 plugin versions prior to 3.9.001

Description The issue allows remote attackers to obtain database credentials due to improper access restriction. This can be achieved via the i4w dbinfo parameter.

Recommendations For versions prior to 3.9.001, update to version 3.9.001 or later to resolve the issue. As a temporary workaround, consider restricting access to the i4w dbinfo parameter to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-3848

Produtos afetados

Imember360

Referências · 8

• 🔥 https://exploit-db.com/exploits/33076 · Exploit
• 🔥 http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html · Exploit
• 🔥 http://exploit-db.com/exploits/33076 · Exploit
• http://releases.imember360.com · Nota
• http://seclists.org/fulldisclosure/2014/Apr/265 · Nota
• http://osvdb.org/106298 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3848 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3848 · Nota de Segurança