PT-2008-4355 · Pre Ads · Pre Ads Portal

M.Hasran Addahroni · Published 2008-06-30 · Updated 2018-10-11 · CVE-2008-2916

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pre ADS Portal versions 2.0 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the cid parameter to "showcategory.php" and the id parameter to "software-description.php" when magic quotes gpc is disabled.

Recommendations For Pre ADS Portal versions 2.0 and earlier, consider disabling the execution of SQL commands via the cid and id parameters in "showcategory.php" and "software-description.php" respectively, until a patch is available. Additionally, enabling magic quotes gpc can help mitigate the risk of SQL injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-2916

Affected Products

Pre Ads Portal

References · 8

• 🔥 http://e-rdc.org/v1/news.php?readmore=98 · Exploit
• 🔥 https://exploit-db.com/exploits/5804 · Exploit
• 🔥 http://securityfocus.com/bid/29709 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-2916 · Security Note
• http://secunia.com/advisories/30689 · Vendor Advisory
• http://securityreason.com/securityalert/3963 · Note
• http://securityfocus.com/archive/1/493371/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43071 · Note