PT-2005-5224 · Dev · Dev Web Management System

Published 2005-12-28 · Updated 2018-10-19 · CVE-2005-4554

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DEV web management system versions 1.5 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the cat parameter in an openforum action in index.php, the cat parameter in getfile.php, and the target parameter in download now.php.

Recommendations For DEV web management system versions 1.5 and earlier, update to a version later than 1.5 to resolve the issue. As a temporary workaround, consider restricting access to the openforum action in index.php, getfile.php, and download now.php to minimize the risk of exploitation. Avoid using the cat parameter in index.php and getfile.php and the target parameter in download now.php until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-4554

Affected Products

Dev Web Management System

References · 13

• 🔥 https://exploit-db.com/exploits/26977 · Exploit
• 🔥 https://exploit-db.com/exploits/1387 · Exploit
• 🔥 http://secunia.com/advisories/18239 · Exploit
• 🔥 http://securityfocus.com/bid/16063 · Exploit
• 🔥 http://securitytracker.com/id?1015410 · Exploit
• 🔥 http://rgod.altervista.org/dev_15_sql_xpl.html · Exploit
• 🔥 https://exploit-db.com/exploits/26976 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4554 · Security Note
• http://securityfocus.com/archive/1/420253/100/0/threaded · Note
• http://osvdb.org/22041 · Note
• http://osvdb.org/22040 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23898 · Note
• http://osvdb.org/22042 · Note