PT-2008-3682 · Phpdirectorysource · Phpdirectorysource

Fisher762 + 1 · Published 2008-05-13 · Updated 2017-09-29 · CVE-2008-2177

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpDirectorySource version 1.1.06

Description The issue concerns SQL injection vulnerabilities. Remote attackers can execute arbitrary SQL commands. This is possible via the lid parameter to "show.php" and the login parameter to "admin.php" when magic quotes gpc is disabled.

Recommendations For phpDirectorySource version 1.1.06, consider disabling the magic quotes gpc feature to prevent SQL injection attacks, or update the show.php and admin.php files to properly sanitize the lid and login parameters. As a temporary workaround, restrict access to the "show.php" and "admin.php" files until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-2177

Affected Products

Phpdirectorysource

References · 7

• 🔥 https://exploit-db.com/exploits/5537 · Exploit
• http://secunia.com/advisories/30056 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2177 · Security Note
• http://vupen.com/english/advisories/2008/1432/references · Note
• http://securityfocus.com/bid/29039 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42213 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42212 · Note