PT-2015-3509 · Redaxscript · Redaxscript

Publicado 2015-01-01 · Atualizado 2015-01-02 · CVE-2011-5313

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Redaxscript version 0.3.2

Description The issue concerns SQL injection vulnerabilities in the includes/password.php file. Remote attackers can execute arbitrary SQL commands by manipulating the id or password parameters in the password reset program. No information is available about the estimated number of potentially affected devices or real-world incidents.

Recommendations For Redaxscript version 0.3.2, consider restricting access to the password reset program until a fix is available, and avoid using the id and password parameters in this program to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2011-5313

Produtos afetados

Redaxscript

Referências · 3

• 🔥 https://htbridge.com/advisory/HTB22804 · Exploit
• 🔥 https://exploit-db.com/exploits/16096 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5313 · Nota de Segurança