PT-2015-5308 · Pragyan · Pragyan Cms

Steffen Rösemann · Publicado 2015-02-12 · Atualizado 2015-02-13 · CVE-2015-1471

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pragyan CMS version 3.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting a SQL injection vulnerability in the userprofile.lib.php file, specifically via the user parameter to the default URI.

Recommendations For Pragyan CMS version 3.0, consider restricting access to the userprofile.lib.php file until a patch is available. As a temporary workaround, avoid using the user parameter in the default URI to minimize the risk of exploitation.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-1471

Produtos afetados

Pragyan Cms

Referências · 10

• 🔥 http://sroesemann.blogspot.de/2015/02/advisory-for-sroeadv-2015-11.html · Exploit
• 🔥 https://exploit-db.com/exploits/35991 · Exploit
• 🔥 http://sroesemann.blogspot.de/2015/01/sroeadv-2015-11.html · Exploit
• 🔥 http://pastebin.com/ip2gGYuS · Exploit
• https://github.com/delta/pragyan/issues/206 · Nota
• https://github.com/delta/pragyan/commit/c93bc100ec93fc78940fbdca9b6b009101858309 · Nota
• http://seclists.org/fulldisclosure/2015/Feb/18 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1471 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1471 · Nota
• http://seclists.org/oss-sec/2015/q1/402 · Nota