PT-2008-6276 · Develop It Easy · Develop It Easy News/Article System

Cyb3R-1St · Published 2008-11-18 · Updated 2017-09-29 · CVE-2008-5131

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Develop It Easy News And Article System version 1.4

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the aid parameter to "article details.php", and the username and password parameters to the admin panel ("admin/index.php").

Recommendations For Develop It Easy News And Article System version 1.4, consider restricting access to the "article details.php" and "admin/index.php" files until a patch is available. As a temporary workaround, avoid using the aid parameter in "article details.php", and the username and password parameters in "admin/index.php" to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-5131

Affected Products

Develop It Easy News/Article System

References · 6

• 🔥 https://exploit-db.com/exploits/7014 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5131 · Security Note
• http://secunia.com/advisories/32595 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46397 · Note
• http://securityreason.com/securityalert/4607 · Note
• http://securityfocus.com/bid/32144 · Note