PT-2009-1365 · Click&Rank · Click&Rank

Alphanix · Published 2009-01-12 · Updated 2017-09-29 · CVE-2008-5888

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Click&Rank (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several API endpoints, including "hitcounter.asp", "user delete.asp", and "user update.asp" using the id parameter, "admin login.asp" using the userid parameter (also referred to as the USERNAME field in "admin.asp"), and "admin login.asp" using the PassWord parameter (also referred to as the PASSWORD field in "admin.asp").

Recommendations For Click&Rank, consider restricting access to the id parameter in "hitcounter.asp", "user delete.asp", and "user update.asp" until a patch is available. As a temporary workaround, restrict the use of the userid parameter in "admin login.asp" to minimize the risk of exploitation. Avoid using the PassWord parameter in "admin login.asp" until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-5888

Affected Products

Click&Rank

References · 5

• 🔥 http://securityfocus.com/bid/32854 · Exploit
• 🔥 https://exploit-db.com/exploits/7486 · Exploit
• http://secunia.com/advisories/33154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5888 · Security Note
• http://securityreason.com/securityalert/4902 · Note