PT-2019-17706 · Earclink · Earclink Espcms-P8

Publicado 2019-01-07 · Atualizado 2019-02-14 · CVE-2019-5488

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions EARCLINK ESPCMS-P8

Description The issue concerns a SQL injection in the install pack/index.php ac=Member&at=verifyAccount endpoint, specifically in the verify key parameter. This could potentially allow an attacker to retrieve sensitive information from the ESPCMS database through the espcms db.php file.

Recommendations For EARCLINK ESPCMS-P8, consider restricting access to the install pack/index.php endpoint, specifically the ac=Member&at=verifyAccount section, to minimize the risk of exploitation. Avoid using the verify key parameter in this endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-5488

Produtos afetados

Earclink Espcms-P8

Referências · 2

• 🔥 http://iwantacve.cn/index.php/archives/108 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5488 · Nota de Segurança