PT-2007-1048 · Just For Fun · Jffnms

Tim Brown · Published 2007-06-12 · Updated 2018-10-16 · CVE-2007-3190

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Just For Fun Network Management System (JFFNMS) version 0.8.3

Description: The issue concerns multiple SQL injection vulnerabilities in the auth.php file of JFFNMS. When magic quotes gpc is disabled, remote attackers can execute arbitrary SQL commands via the user and pass parameters. This could potentially lead to a breach of confidentiality and integrity of protected information. The exploitation of these vulnerabilities can be done remotely.

Recommendations: For JFFNMS version 0.8.3, consider disabling the auth.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent SQL injection attacks. Avoid using the user and pass parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-04130

CVE-2007-3190

DSA-1374-1

Affected Products

Jffnms

References · 13

• 🔥 https://exploit-db.com/exploits/30171 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3191 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3189 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-3190 · Security Note
• http://debian.org/security/2007/dsa-1374 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04130 · Security Note
• http://secunia.com/advisories/25587 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3190 · Security Note
• http://marc.info/?l=full-disclosure&m=118151087109711&w=2 · Note
• http://securityfocus.com/bid/24414 · Note
• http://securityfocus.com/archive/1/471039/100/0/threaded · Note
• http://debian.org/security/dsa-1374 · Note
• http://secunia.com/advisories/26769 · Note