PT-2017-7404 · Bitrix · Orion.Extfeedbackform

Publicado 2017-08-24 · Atualizado 2018-10-09 · CVE-2015-8355

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bitrix orion.extfeedbackform module versions prior to 2.1.3

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the order or "by" parameter to the "admin/orion.extfeedbackform efbf forms.php" endpoint.

Recommendations For versions prior to 2.1.3, update the orion.extfeedbackform module to version 2.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "admin/orion.extfeedbackform efbf forms.php" endpoint and avoid using the order or "by" parameters until the update is applied.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-8355

Produtos afetados

Orion.Extfeedbackform

Referências · 3

• 🔥 https://htbridge.com/advisory/HTB23280 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-8355 · Nota de Segurança
• http://securityfocus.com/archive/1/537130/100/0/threaded · Nota