PT-2008-5968 · Php · Php-Daily

0Xffffff · Published 2008-10-28 · Updated 2017-09-29 · CVE-2008-4757

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Daily (affected versions not specified)

Description The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This is achieved through the id parameter in scripts such as add postit.php, delete.php, and mod prest date.php, and the prev parameter in prest detail.php. No information is provided about the estimated number of potentially affected devices or real-world incidents.

Recommendations For PHP-Daily, consider restricting access to the add postit.php, delete.php, mod prest date.php, and prest detail.php scripts until a fix is available. As a temporary workaround, avoid using the id and prev parameters in the affected scripts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-4757

Affected Products

Php-Daily

References · 4

• 🔥 https://exploit-db.com/exploits/6833 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4757 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46125 · Note
• http://securityfocus.com/bid/31915 · Note