PT-2009-4788 · Tekradius · Tekradius

Tim Brown · Published 2009-07-07 · Updated 2018-10-10 · CVE-2009-2359

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TekRADIUS version 3.0

Description The issue allows context-dependent attackers to execute arbitrary SQL commands. This can be achieved via the GUI client, for example, by input to the Browse Users text box in the Users tab, or via the command-line client using a certain trcli -r command.

Recommendations For TekRADIUS version 3.0, consider restricting access to the GUI client and command-line client until a patch is available. As a temporary workaround, avoid using the Browse Users text box in the Users tab and refrain from using the trcli -r command.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-2359

Affected Products

Tekradius

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2009-2359 · Security Note
• http://vupen.com/english/advisories/2009/1816 · Note
• http://nth-dimension.org.uk/utils/get.php?downloadsid=56 · Note
• http://securityfocus.com/archive/1/504740/100/0/threaded · Note