PT-2007-2599 · Nukesentinel · Nukesentinel

Darkfig · Published 2007-02-28 · Updated 2018-10-16 · CVE-2007-1172

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions NukeSentinel versions 2.5.05 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header. This can lead to unauthorized access and manipulation of sensitive data.

Recommendations For versions 2.5.05 and earlier, consider restricting access to the nukesentinel.php file until a patch is available. As a temporary workaround, avoid using the Client-IP HTTP header in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-1172

Affected Products

Nukesentinel

References · 6

• 🔥 https://exploit-db.com/exploits/3338 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1172 · Security Note
• http://securityreason.com/securityalert/2341 · Note
• http://secunia.com/advisories/24221 · Note
• http://securityfocus.com/archive/1/460599/100/0/threaded · Note
• http://attrition.org/pipermail/vim/2007-March/001429.html · Note