PT-2005-5254 · Phpsurveyor · Php Surveyor

Published 2005-12-30 · Updated 2008-09-05 · CVE-2005-4586

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPSurveyor versions prior to 0.991

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the sql parameter in "browse.php" and the sid, lid, gid, and token parameters in certain PHP scripts.

Recommendations For versions prior to 0.991, update to version 0.991 or later to resolve the issue. As a temporary workaround, consider restricting access to the "browse.php" script and the parameters sid, lid, gid, and token in affected PHP scripts to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-4586

Affected Products

Php Surveyor

References · 8

• http://securityfocus.com/bid/16077 · Patch
• http://sourceforge.net/project/shownotes.php?release_id=381050&group_id=74605 · Patch
• http://secunia.com/advisories/18167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4586 · Security Note
• http://osvdb.org/22184 · Note
• http://phpsurveyor.org/mantis/view.php?id=287 · Note
• http://phpsurveyor.org/mantis/view.php?id=286 · Note
• http://osvdb.org/22039 · Note