PT-2014-6281 · Ol Commerce · Ol-Commerce

Publicado 2014-07-28 · Atualizado 2014-07-29 · CVE-2014-5104

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ol-commerce version 2.1.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters in different PHP files, including the a country parameter in the "affiliate signup.php" file, the affiliate banner id parameter in the "affiliate show banner.php" file, the country parameter in the "create account.php" file, or the entry country id parameter in the "admin/create account.php" file.

Recommendations For ol-commerce version 2.1.1, consider restricting access to the vulnerable parameters a country, affiliate banner id, country, and entry country id in their respective PHP files until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoints or files.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-5104

Produtos afetados

Ol-Commerce

Referências · 7

• 🔥 https://exploit-db.com/exploits/39346 · Exploit
• 🔥 https://exploit-db.com/exploits/39344 · Exploit
• 🔥 http://securityfocus.com/bid/68719 · Exploit
• 🔥 http://packetstormsecurity.com/files/127521/OL-Commerce-2.1.1-Cross-Site-Scripting-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/39343 · Exploit
• 🔥 https://exploit-db.com/exploits/39345 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5104 · Nota de Segurança