PT-2007-5289 · Alstrasoft · Alstrasoft Video Share Enterprise

Published 2007-07-30 · Updated 2008-11-15 · CVE-2007-4086

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlstraSoft Video Share Enterprise (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the gid parameter to "gmembers.php", or the UID parameter to several pages, including "uvideos.php", "ugroups.php", "uprofile.php", "ufavour.php", "ufriends.php", and "uplaylist.php".

Recommendations As a temporary workaround, consider restricting access to the gid parameter in "gmembers.php" and the UID parameter in the affected pages until a patch is available. Avoid using the gid and UID parameters in the respective API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-4086

Affected Products

Alstrasoft Video Share Enterprise

References · 9

• 🔥 http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4086 · Security Note
• http://osvdb.org/37878 · Note
• http://osvdb.org/37874 · Note
• http://osvdb.org/37875 · Note
• http://osvdb.org/37876 · Note
• http://osvdb.org/37872 · Note
• http://osvdb.org/37877 · Note
• http://osvdb.org/37873 · Note