PT-2004-2858 · Unknown · Protector System

Published 2004-04-23 · Updated 2016-12-20 · CVE-2004-1961

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Protector System version 1.15b1

Description The issue allows remote attackers to bypass SQL injection protection and execute limited SQL commands. This is achieved by using URL-encoded "'" characters ("%27") in the blocker.php file.

Recommendations For Protector System version 1.15b1, consider restricting access to the blocker.php file until a patch is available, or apply configuration changes to prevent the use of URL-encoded "'" characters ("%27") to bypass SQL injection protection.

Exploit

Fix

Related Identifiers

CVE-2004-1961

Affected Products

Protector System

References · 5

• 🔥 http://waraxe.us/index.php?modname=sa&id=25 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1961 · Security Note
• http://securityfocus.com/bid/10206 · Note
• http://protector.warcenter.se/article-53--0-0.html · Note
• http://securityfocus.com/archive/1/361300/2004-04-21/2004-04-27/0 · Note