PT-2009-5005 · Traidnt · Traidnt Up

Qabandi · Published 2009-07-27 · Updated 2017-09-19 · CVE-2009-2605

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Traidnt Up version 2.0

Description The issue concerns SQL injection vulnerabilities in the adminquery.php file. Remote attackers can execute arbitrary SQL commands by manipulating the trupuser and truppassword cookies to access the uploadcp/index.php endpoint.

Recommendations For Traidnt Up version 2.0, consider restricting access to the adminquery.php file and the uploadcp/index.php endpoint until a fix is available. As a temporary workaround, avoid using the trupuser and truppassword cookies in the affected endpoint to minimize the risk of exploitation.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-2605

Affected Products

Traidnt Up

References · 7

• 🔥 http://exploit-db.com/exploits/8831 · Exploit
• 🔥 https://exploit-db.com/exploits/8831 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2605 · Security Note
• http://secunia.com/advisories/35273 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2605 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50866 · Note
• http://osvdb.org/54809 · Note