PT-2017-17718 · Websitebaker · Websitebaker

Marek Alaksa · Publicado 2017-04-03 · Atualizado 2020-07-07 · CVE-2017-7410

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebsiteBaker versions 2.10.0 and earlier

Description The issue concerns SQL injection vulnerabilities in certain PHP files. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via the username and display name parameters.

Recommendations For versions 2.10.0 and earlier, update to a version later than 2.10.0 to resolve the issue. As a temporary workaround, consider restricting access to the account/signup.php and account/signup2.php files until a patch is available. Avoid using the username and display name parameters in the affected files until the issue is resolved.

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-7410

Produtos afetados

Websitebaker

Referências · 6

• http://project.websitebaker.org/issues/39 · Aviso do Fabricante
• http://securitytracker.com/id/1038173 · Nota
• http://forum.websitebaker.org/index.php/topic%2C30187.0.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7410 · Nota de Segurança
• http://securityfocus.com/bid/97495 · Nota
• https://osv.dev/vulnerability/CVE-2017-7410 · Aviso do Fabricante