PT-2009-2376 · Gigs · Gigs

Staker · Published 2009-08-06 · Updated 2017-09-29 · CVE-2008-6907

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: 2532|Gigs version 1.2.2

Description: The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities in the checkuser.php file. This occurs when magic quotes gpc is disabled, and attackers can exploit the username and password parameters, which are accessible from a form generated by index.php.

Recommendations: For version 1.2.2, consider disabling the checkuser.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent SQL injection attacks. Avoid using the username and password parameters in the affected form until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-6907

Affected Products

Gigs

References · 5

• 🔥 http://securityfocus.com/bid/32913 · Exploit
• 🔥 https://exploit-db.com/exploits/7511 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6907 · Security Note
• http://secunia.com/advisories/26585 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47491 · Note