PT-2009-1839 · Ad Server Solutions · Ad Server Solutions Affiliate

R3D-D3V!L · Published 2009-03-02 · Updated 2017-09-29 · CVE-2008-6366

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Ad Server Solutions Affiliate Software Java version 4.0

Description: The issue allows remote attackers to execute arbitrary SQL commands, possibly related to the uname and pass parameters to "logon process.jsp". This is achieved via the username and password in "logon.jsp".

Recommendations: For Ad Server Solutions Affiliate Software Java version 4.0, consider restricting access to the "logon.jsp" and "logon process.jsp" pages until a fix is available, and avoid using the uname and pass parameters in the "logon process.jsp" endpoint to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-6366

Affected Products

Ad Server Solutions Affiliate

References · 7

• 🔥 http://packetstorm.linuxsecurity.com/0812-exploits/affiliatesj-sql.txt · Exploit
• 🔥 http://securityfocus.com/bid/32791 · Exploit
• 🔥 https://exploit-db.com/exploits/32655 · Exploit
• 🔥 https://exploit-db.com/exploits/7423 · Exploit
• http://secunia.com/advisories/33072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6366 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47280 · Note