PT-2005-3606 · Pafiledb · Pafiledb

Deluxe89 · Published 2005-08-29 · Updated 2017-07-11 · CVE-2005-2723

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PaFileDB version 3.1

Description A SQL injection issue exists in the auth.php file of PaFileDB when the authmethod is set to cookies. This allows remote attackers to execute arbitrary SQL commands by manipulating the username value in the pafiledbcookie cookie.

Recommendations For PaFileDB version 3.1, update the auth.php file to properly sanitize the username value in the pafiledbcookie cookie to prevent SQL injection attacks. As a temporary workaround, consider restricting access to the auth.php file or disabling the use of cookies as an authmethod until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2005-2723

Affected Products

Pafiledb

References · 6

• 🔥 http://securityfocus.com/bid/14654 · Exploit
• http://security-project.org/projects/board/showthread.php?t=947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2723 · Security Note
• http://secunia.com/advisories/16566 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21988 · Note
• http://marc.info/?l=bugtraq&m=112490781927680&w=2 · Note