PT-2015-3678 · Couponphp · Couponphp

Gjoko Krstic · Publicado 2015-01-13 · Atualizado 2017-09-08 · CVE-2014-10034

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions couponPHP versions prior to 1.2.0

Description The issue concerns SQL injection vulnerabilities in the admin area. These vulnerabilities allow remote administrators to execute arbitrary SQL commands. The vulnerabilities are specifically related to the iDisplayLength and iDisplayStart parameters in the API endpoints "comments paginate.php" and "stores paginate.php" located in "admin/ajax/".

Recommendations For versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "comments paginate.php" and "stores paginate.php" files in "admin/ajax/" to minimize the risk of exploitation. Avoid using the iDisplayLength and iDisplayStart parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-10034

Produtos afetados

Couponphp

Referências · 9

• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2014-5170.php · Exploit
• 🔥 https://exploit-db.com/exploits/32037 · Exploit
• 🔥 http://exploit-db.com/exploits/32037 · Exploit
• 🔥 http://packetstormsecurity.com/files/125480 · Exploit
• http://osvdb.org/show/osvdb/103895 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-10034 · Nota de Segurança
• http://osvdb.org/show/osvdb/103896 · Nota
• http://couponphp.com/changelog · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91550 · Nota