PT-2005-4619 · Unknown · Enterprise Connector

Published 2005-11-29 · Updated 2011-03-08 · CVE-2005-3875

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Enterprise Connector versions 1.0.2 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the messageid parameter in either the "send.php" or a delete action in "messages.php" API endpoints.

Recommendations For Enterprise Connector versions 1.0.2 and earlier, consider restricting access to the send.php and messages.php endpoints until a patch is available. As a temporary workaround, avoid using the messageid parameter in these endpoints to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-3875

Affected Products

Enterprise Connector

References · 9

• 🔥 https://exploit-db.com/exploits/26603 · Exploit
• 🔥 https://exploit-db.com/exploits/26602 · Exploit
• http://secunia.com/advisories/17743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3875 · Security Note
• http://vupen.com/english/advisories/2005/2602 · Note
• http://securityfocus.com/bid/15578 · Note
• http://pridels0.blogspot.com/2005/11/enterprise-connector-sql-inj-vuln.html · Note
• http://osvdb.org/21142 · Note
• http://osvdb.org/21141 · Note