PT-2008-5823 · Ip Reg · Ip Reg

Joss · Published 2008-10-17 · Updated 2017-09-29 · CVE-2008-4606

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IP Reg versions 0.4 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the location id parameter to "locationdel.php" and the vlan id parameter to "vlanedit.php".

Recommendations For IP Reg versions 0.4 and earlier, avoid using the location id parameter in "locationdel.php" and the vlan id parameter in "vlanedit.php" until the issue is resolved. Consider restricting access to these endpoints as a temporary mitigation measure.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-4606

Affected Products

Ip Reg

References · 7

• 🔥 https://exploit-db.com/exploits/6765 · Exploit
• 🔥 http://securityfocus.com/bid/31781 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4606 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45934 · Note
• http://osvdb.org/show/osvdb/49231 · Note
• http://osvdb.org/show/osvdb/49232 · Note
• http://securityreason.com/securityalert/4435 · Note