PT-2004-3458 · Recipants · Recipants

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2567

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ReciPants version 1.1.1

Description The issue allows remote attackers to execute arbitrary SQL commands via several ID number fields, including the user id, recipe id, category id, and other ID fields. This can potentially lead to unauthorized access and manipulation of data.

Recommendations For ReciPants version 1.1.1, consider restricting access to the SQL database and validating user input to prevent SQL injection attacks. As a temporary workaround, restrict the use of the ID number fields until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2004-2567

Affected Products

Recipants

References · 6

• http://sourceforge.net/project/shownotes.php?group_id=90737&release_id=234415 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-2567 · Security Note
• http://secunia.com/advisories/11533 · Vendor Advisory
• http://securitytracker.com/id?1009984 · Patch
• http://securityfocus.com/bid/10250 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16024 · Note