PT-2005-2610 · Jgs Xa · Jgs-Portal

Deluxe89 · Published 2005-05-17 · Updated 2016-10-18 · CVE-2005-1633

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JGS-XA JGS-Portal versions 3.0.2 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including anzahl beitraege to "jgs portal.php", year to "jgs portal statistik.php", "jgs portal beitraggraf.php", "jgs portal themengraf.php", and "jgs portal mitgraf.php", tag to "jgs portal viewsgraf.php", id to "jgs portal sponsor.php", or the Accept-Language header to "jgs portal log.php".

Recommendations For JGS-XA JGS-Portal versions 3.0.2 and earlier, consider disabling the affected parameters, such as anzahl beitraege, year, tag, and id, until a patch is available. Additionally, restrict access to the Accept-Language header in "jgs portal log.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2005-1633

Affected Products

Jgs-Portal

References · 10

• 🔥 https://exploit-db.com/exploits/25678 · Exploit
• 🔥 https://exploit-db.com/exploits/25676 · Exploit
• 🔥 https://exploit-db.com/exploits/25677 · Exploit
• 🔥 https://exploit-db.com/exploits/25673 · Exploit
• 🔥 https://exploit-db.com/exploits/25675 · Exploit
• 🔥 https://exploit-db.com/exploits/25679 · Exploit
• 🔥 https://exploit-db.com/exploits/25674 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1633 · Security Note
• http://marc.info/?l=bugtraq&m=111627681218415&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1633 · Note