PT-2005-4498 · Phpcomasy · Phpcomasy

Published 2005-11-22 · Updated 2011-08-05 · CVE-2005-3744

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpComasy versions 0.7.5 and earlier

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. The issue is related to the id parameter. However, an examination of the source code suggests that the id parameter is not directly handled by index.php.

Recommendations For phpComasy versions 0.7.5 and earlier, consider restricting access to the index.php file until a fix is available. Avoid using the id parameter in the affected API endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2005-3744

Affected Products

Phpcomasy

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-3744 · Security Note
• http://vupen.com/english/advisories/2005/2507 · Vendor Advisory
• http://secunia.com/advisories/17660 · Vendor Advisory
• http://osvdb.org/20984 · Note
• http://pridels0.blogspot.com/2005/11/phpcomasy-id-sql-injection.html · Note
• http://securityfocus.com/bid/15511 · Note