PT-2009-4616 · Kjtechforce · Kjtechforce Mailman

Yenh4Cker · Published 2009-06-22 · Updated 2018-10-10 · CVE-2009-2164

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Kjtechforce mailman version beta1

Description The issue concerns SQL injection vulnerabilities. These occur when an application uses user input to construct SQL queries without proper validation, allowing attackers to inject malicious SQL code. In this case, the vulnerabilities are present in the Kjtechforce mailman beta1 version, specifically when the magic quotes gpc setting is disabled. This setting is used to automatically escape any special characters in user input, which can help prevent SQL injection attacks. With magic quotes gpc disabled, remote attackers can execute arbitrary SQL commands. This can be achieved through two specific API endpoints: "activate.php" by manipulating the code parameter, and "index.php" by manipulating the dest parameter.

Recommendations For Kjtechforce mailman version beta1, consider disabling the activate.php and index.php scripts until a patch is available, or ensure that the magic quotes gpc setting is enabled to mitigate the risk of SQL injection attacks. Additionally, restrict access to these scripts to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-2164

Affected Products

Kjtechforce Mailman

References · 4

• 🔥 https://exploit-db.com/exploits/8884 · Exploit
• 🔥 https://exploit-db.com/exploits/8885 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2164 · Security Note
• http://securityfocus.com/archive/1/504136/100/0/threaded · Note