PT-2008-1910 · Eticket · Eticket

Published 2008-01-15 · Updated 2018-10-15 · CVE-2008-0266

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions eTicket version 1.5.5.2

Description A cross-site request forgery (CSRF) issue in the admin.php file allows remote attackers to change the administrative password and possibly perform other administrative tasks, provided they either know the old password or can leverage a separate SQL injection vulnerability.

Recommendations For eTicket version 1.5.5.2, as a temporary workaround, consider restricting access to the admin.php file until a patch is available. Additionally, ensure that the old password is not known to unauthorized parties and mitigate the risk of SQL injection vulnerabilities to prevent leverage by attackers.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-0266

Affected Products

Eticket

References · 8

• 🔥 http://securityfocus.com/bid/27173 · Exploit
• 🔥 https://exploit-db.com/exploits/30994 · Exploit
• http://secunia.com/advisories/28331 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0266 · Security Note
• http://securityfocus.com/archive/1/485835/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39490 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0266 · Note
• http://securityreason.com/securityalert/3542 · Note