PT-2007-3941 · Taskdriver · Taskdriver

Silentz · Published 2007-05-11 · Updated 2017-10-11 · CVE-2007-2622

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TaskDriver versions 1.2 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the username parameter to "login.php" or the taskid parameter to "notes.php".

Recommendations For TaskDriver versions 1.2 and earlier, update to a version later than 1.2 to resolve the issue. As a temporary workaround, consider restricting access to the "login.php" and "notes.php" endpoints until a patch is available. Avoid using the username and taskid parameters in the affected endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-2622

Affected Products

Taskdriver

References · 8

• 🔥 https://exploit-db.com/exploits/3896 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2622 · Security Note
• http://vupen.com/english/advisories/2007/1768 · Note
• http://securityfocus.com/bid/23919 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34249 · Note
• http://osvdb.org/35973 · Note
• http://osvdb.org/35972 · Note
• http://secunia.com/advisories/25221 · Note