PT-2007-4937 · Avtutorial · Av Tutorial Script

Published 2007-07-11 · Updated 2017-07-29 · CVE-2007-3691

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AV Tutorial Script (avtutorial) version 1.0

Description The issue is related to SQL injection vulnerabilities in the changePW.php file. When magic quotes gpc is disabled, remote attackers can execute arbitrary SQL commands via the id and userid parameters.

Recommendations For AV Tutorial Script (avtutorial) version 1.0, consider disabling the changePW.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent SQL injection attacks. Avoid using the id and userid parameters in the changePW.php file until the issue is resolved.

Fix

Related Identifiers

CVE-2007-3691

Affected Products

Av Tutorial Script

References · 5

• http://secunia.com/advisories/25969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3691 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35487 · Note
• http://attrition.org/pipermail/vim/2007-July/001705.html · Note
• http://osvdb.org/36298 · Note