PT-2009-5145 · Arab Portal · Arab Portal

Recruit · Published 2009-08-17 · Updated 2017-09-19 · CVE-2009-2781

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Arab Portal versions 2.x

Description The issue allows remote authenticated users to execute arbitrary SQL commands via the qc parameter in an "addcomment" action in the forum.php file, but only when magic quotes gpc is disabled.

Recommendations For Arab Portal version 2.x, consider disabling the addcomment action in the forum.php file until a patch is available, or ensure that magic quotes gpc is enabled to prevent exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-2781

Affected Products

Arab Portal

References · 5

• 🔥 http://securityfocus.com/bid/35914 · Exploit
• 🔥 http://exploit-db.com/exploits/9320 · Exploit
• 🔥 https://exploit-db.com/exploits/9320 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2781 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2781 · Note