PT-2018-18090 · Textpattern · Textpattern Cms

Manuel García Cárdenas · Publicado 2018-03-14 · Atualizado 2018-04-11 · CVE-2018-7474

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Textpattern CMS versions 4.6.2 and earlier

Description An issue allows SQL code injection in the qty variable on the "index.php" page.

Recommendations For Textpattern CMS versions 4.6.2 and earlier, update to a version later than 4.6.2 to resolve the issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-7474

Produtos afetados

Textpattern Cms

Referências · 5

• 🔥 https://exploit-db.com/exploits/44277 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Mar/34 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7474 · Nota
• https://osv.dev/vulnerability/CVE-2018-7474 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7474 · Nota de Segurança