PT-2019-11977 · Domoticz · Domoticz

Fabio Carretto · Publicado 2019-03-31 · Atualizado 2019-05-03 · CVE-2019-10664

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Domoticz versions prior to 4.10578

Description The issue allows SQL Injection via the idx parameter in the CWebServer::GetFloorplanImage function in WebServer.cpp.

Recommendations For versions prior to 4.10578, update to version 4.10578 or later to resolve the issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-10664

Produtos afetados

Domoticz

Referências · 5

• 🔥 https://exploit-db.com/exploits/46773 · Exploit
• https://github.com/domoticz/domoticz/commit/ee70db46f81afa582c96b887b73bcd2a86feda00 · Correção
• http://packetstormsecurity.com/files/152678/Domoticz-4.10577-Unauthenticated-Remote-Command-Execution.html · Nota
• https://osv.dev/vulnerability/CVE-2019-10664 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10664 · Nota de Segurança