PT-2005-4952 · Php · Php Support Tickets

Published 2005-12-15 · Updated 2011-03-08 · CVE-2005-4264

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP Support Tickets version 2.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the username and password fields, and the id parameter.

Recommendations For PHP Support Tickets version 2.0, consider validating and sanitizing user input for the username, password, and id parameter to prevent SQL injection attacks. As a temporary workaround, restrict access to the index.php file until a patch is available.

Fix

Related Identifiers

CVE-2005-4264

Affected Products

Php Support Tickets

References · 8

• http://securitytracker.com/id?1015352 · Patch
• http://nii.co.in/vuln/PHPSupportTickets.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4264 · Security Note
• http://secunia.com/advisories/18067 · Note
• http://securityfocus.com/bid/15853 · Note
• http://osvdb.org/21730 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4264 · Note
• http://vupen.com/english/advisories/2005/2928 · Note