PT-2019-13902 · Imcat · Imcat

Kernelcop · Publicado 2019-08-12 · Atualizado 2019-08-15 · CVE-2019-14968

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions imcat version 4.9

Description An issue was discovered that allows SQL Injection via the "order" parameter in the "index.php" endpoint, specifically when the "mod" parameter is set to "faqs".

Recommendations For imcat version 4.9, consider restricting access to the vulnerable index.php endpoint with mod=faqs action until a patch is available. Avoid using the order parameter in this endpoint to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-14968

Produtos afetados

Imcat

Referências · 3

• 🔥 https://github.com/peacexie/imcat/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14968 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-14968 · Aviso do Fabricante