PT-2008-5606 · Kasseler · Kasseler Cms

~!Dok_Tor!~ · Published 2008-09-30 · Updated 2017-09-29 · CVE-2008-4356

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Kasseler CMS versions 1.1.0 through 1.2.0

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including the nid parameter to "index.php" in a View action to the News module, the vid parameter to "index.php" in a Result action to the Voting module, the fid parameter to "index.php" in a ShowForum action to the Forum module, the tid parameter to "index.php" in a ShowTopic action to the Forum module, the uname parameter to "index.php" in a UserInfo action to the Account module, or the module parameter to "index.php", which is probably related to the TopSites module.

Recommendations: For Kasseler CMS version 1.1.0, update to a version that fixes the SQL injection vulnerabilities. For Kasseler CMS version 1.2.0, update to a version that fixes the SQL injection vulnerabilities. As a temporary workaround, consider restricting access to the vulnerable modules, such as the News, Voting, Forum, and Account modules, until a patch is available. Avoid using the parameters nid, vid, fid, tid, uname, and module in the affected API endpoints until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-4356

Affected Products

Kasseler Cms

References · 5

• 🔥 https://exploit-db.com/exploits/6460 · Exploit
• 🔥 http://securityfocus.com/bid/31170 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4356 · Security Note
• http://secunia.com/advisories/31862 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45120 · Note