PT-2006-4047 · Phptrader · Phptrader
Published
2006-06-22
·
Updated
2017-07-20
·
CVE-2006-3152
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
phpTRADER versions 4.9 SP5 and earlier
Description
The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in various parameters across multiple PHP files, including the
sectio parameter in files such as "login.php", "write newad.php", "newad.php", "printad.php", "askseller.php", "browse.php", "showmemberads.php", "note ad.php", "abuse.php", "buynow.php", and "confirm newad.php", the an parameter in "printad.php" and "note ad.php", the who parameter in "showmemberads.php", and the adnr parameter in "buynow.php".Recommendations
For phpTRADER versions 4.9 SP5 and earlier, as a temporary workaround, consider restricting access to the vulnerable parameters
sectio, an, who, and adnr in the respective PHP files until a patch is available. Additionally, restrict access to the affected API endpoints, such as those in "login.php", "write newad.php", "newad.php", "printad.php", "askseller.php", "browse.php", "showmemberads.php", "note ad.php", "abuse.php", "buynow.php", and "confirm newad.php", to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Phptrader