PT-2008-3979 · Blizzard · Battle.Net Clan Script For Php

Stack-Terrorist · Published 2008-06-03 · Updated 2017-09-29 · CVE-2008-2522

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Battle.net Clan Script for PHP versions 1.5.3 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible when the magic quotes gpc setting is disabled. The exploitation occurs through the showmember parameter in a members action.

Recommendations For Battle.net Clan Script for PHP versions 1.5.3 and earlier, consider disabling the members.php file or restricting access to it until a fix is available. As a temporary workaround, enable the magic quotes gpc setting to prevent SQL injection attacks. Avoid using the showmember parameter in the members action until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-2522

Affected Products

Battle.Net Clan Script For Php

References · 5

• 🔥 https://exploit-db.com/exploits/5597 · Exploit
• http://secunia.com/advisories/30211 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2522 · Security Note
• http://securityfocus.com/bid/29166 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42354 · Note