PT-2019-9527 · Mlm · Gift Mlm+9

Publicado 2019-05-24 · Atualizado 2019-05-29 · CVE-2018-17843

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ADD Clicking MLM Software version 1.0 Binary MLM Software version 1.0 Level MLM Software version 1.0 Singleleg MLM Software version 1.0 Autopool MLM Software version 1.0 Investment MLM Software version 1.0 Bidding MLM Software version 1.0 Moneyorder MLM Software version 1.0 Repurchase MLM Software version 1.0 Gift MLM Software version 1.0

Description The issue exists due to SQL injection in several MLM software products. This is caused by the msg id parameter in "member/readmsg.php", the pid parameter in "member/tree.php", or the m id parameter in "member/downline.php".

Recommendations For ADD Clicking MLM Software version 1.0, consider disabling the msg id parameter in "member/readmsg.php", the pid parameter in "member/tree.php", and the m id parameter in "member/downline.php" until a patch is available. For Binary MLM Software version 1.0, consider disabling the msg id parameter in "member/readmsg.php", the pid parameter in "member/tree.php", and the m id parameter in "member/downline.php" until a patch is available. For Level MLM Software version 1.0, consider disabling the msg id parameter in "member/readmsg.php", the pid parameter in "member/tree.php", and the m id parameter in "member/downline.php" until a patch is available. For Singleleg MLM Software version 1.0, consider disabling the msg id parameter in "member/readmsg.php", the pid parameter in "member/tree.php", and the m id parameter in "member/downline.php" until a patch is available. For Autopool MLM Software version 1.0, consider disabling the msg id parameter in "member/readmsg.php", the pid parameter in "member/tree.php", and the m id parameter in "member/downline.php" until a patch is available. For Investment MLM Software version 1.0, consider disabling the msg id parameter in "member/readmsg.php", the pid parameter in "member/tree.php", and the m id parameter in "member/downline.php" until a patch is available. For Bidding MLM Software version 1.0, consider disabling the msg id parameter in "member/readmsg.php", the pid parameter in "member/tree.php", and the m id parameter in "member/downline.php" until a patch is available. For Moneyorder MLM Software version 1.0, consider disabling the msg id parameter in "member/readmsg.php", the pid parameter in "member/tree.php", and the m id parameter in "member/downline.php" until a patch is available. For Repurchase MLM Software version 1.0, consider disabling the msg id parameter in "member/readmsg.php", the pid parameter in "member/tree.php", and the m id parameter in "member/downline.php" until a patch is available. For Gift MLM Software version 1.0, consider disabling the msg id parameter in "member/readmsg.php", the pid parameter in "member/tree.php", and the m id parameter in "member/downline.php" until a patch is available.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-17843

Produtos afetados

Add Clicking Mlm

Autopool Mlm

Bidding Mlm

Binary Mlm

Gift Mlm

Investment Mlm

Level Mlm

Moneyorder Mlm

Repurchase Mlm

Singleleg Mlm

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-17843 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17843 · Nota de Segurança
• https://exploit-db.com/author/?a=8844 · Nota
• https://exploit-db.com/exploits/45511 · Nota