PT-2009-1434 · Unknown · Active Test

R3D-D3V!L · Published 2009-01-23 · Updated 2017-09-29 · CVE-2008-5959

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Active Test version 2.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the useremail parameter (also known as the username field) or the password parameter (also known as the password field) in the start.asp file.

Recommendations For Active Test version 2.1, consider restricting access to the start.asp file until a fix is available. As a temporary workaround, avoid using the useremail and password parameters in the start.asp file to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-5959

Affected Products

Active Test

References · 5

• 🔥 https://exploit-db.com/exploits/7276 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5959 · Security Note
• http://secunia.com/advisories/32902 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46921 · Note
• http://osvdb.org/50408 · Note