PT-2005-3452 · Myfaq · Myfaq

Published 2005-08-16 · Updated 2016-10-18 · CVE-2005-2561

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MYFAQ version 1.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several API endpoints, including 'affichagefaq.php3', 'choixsoustheme.php3', 'consultation.php3', 'insfaq.php3', 'inssoustheme.php3', 'instheme.php3', 'saisiefaqtotale.php3', 'saisiesoustheme.php3', and 'voirfaq.php3'. Vulnerable parameters include the Theme parameter, the SousTheme parameter, the Faq parameter, and the question parameter.

Recommendations For MYFAQ version 1.0, as a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is available. Avoid using the Theme, SousTheme, Faq, and question parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-2561

Affected Products

Myfaq

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-2561 · Security Note
• http://securityfocus.com/bid/14503 · Note
• http://secunia.com/advisories/16366 · Note
• http://marc.info/?l=bugtraq&m=112352204602309&w=2 · Note
• http://svt.nukleon.us/lab/svadvisory13.txt · Note