PT-2015-4969 · Sefrengo · Sefrengo

Steffen Rösemann · Publicado 2015-01-08 · Atualizado 2015-01-08 · CVE-2015-0919

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sefrengo versions prior to 1.6.1

Description The issue allows remote administrators to execute arbitrary SQL commands. This is possible via the idcat or idclient parameter to the "backend/main.php" endpoint.

Recommendations For versions prior to 1.6.1, update to version 1.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "backend/main.php" endpoint and avoid using the idcat and idclient parameters until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-0919

Produtos afetados

Sefrengo

Referências · 6

• 🔥 http://seclists.org/fulldisclosure/2015/Jan/9 · Exploit
• 🔥 https://exploit-db.com/exploits/35722 · Exploit
• 🔥 http://packetstormsecurity.com/files/129824/Sefrengo-CMS-1.6.0-SQL-Injection.html · Exploit
• 🔥 http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-04.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-0919 · Nota de Segurança
• http://forum.sefrengo.org/index.php?showtopic=3360 · Aviso do Fabricante