PT-2009-4139 · Easy Scripts · Easy Scripts Answer/Question Script

Cyb3R-1St · Published 2009-05-16 · Updated 2017-09-29 · CVE-2009-1655

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Easy Scripts Answer and Question Script (affected versions not specified)

Description: The issue concerns SQL injection vulnerabilities in the myaccount.php file. These vulnerabilities allow remote authenticated users to execute arbitrary SQL commands. The vulnerabilities can be exploited via the userid parameter and the password.

Recommendations: For all affected versions, consider restricting access to the myaccount.php file until a patch is available. As a temporary workaround, avoid using the userid parameter in the affected file to minimize the risk of exploitation. Additionally, restrict the use of password inputs in myaccount.php to reduce the risk of SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-1655

Affected Products

Easy Scripts Answer/Question Script

References · 5

• 🔥 https://exploit-db.com/exploits/8690 · Exploit
• 🔥 http://securityfocus.com/bid/34975 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1655 · Security Note
• http://secunia.com/advisories/35067 · Vendor Advisory
• http://osvdb.org/54502 · Note