PT-2008-3685 · Cplinks · Cplinks

Fisher762 + 1 · Published 2008-05-13 · Updated 2017-09-29 · CVE-2008-2180

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cpLinks version 1.03

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the admin username parameter to "admin/index.php" and the search text and search category parameters to "search.php", when magic quotes gpc is disabled.

Recommendations For cpLinks version 1.03, consider disabling the use of the admin username, search text, and search category parameters until a patch is available. Additionally, enabling magic quotes gpc can help mitigate the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-2180

Affected Products

Cplinks

References · 6

• 🔥 https://exploit-db.com/exploits/5538 · Exploit
• http://secunia.com/advisories/30024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2180 · Security Note
• http://vupen.com/english/advisories/2008/1431/references · Note
• http://securityfocus.com/bid/29035 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42170 · Note