PT-2009-5276 · Php · Php Competition System

Mr.Sql · Published 2009-08-21 · Updated 2017-09-19 · CVE-2009-2926

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHP Competition System versions BETA 0.84 and earlier

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the day parameter to "show matchs.php" and the pageno parameter to "persons.php".

Recommendations: For PHP Competition System versions BETA 0.84 and earlier, consider updating to a newer version that addresses the SQL injection vulnerabilities. As a temporary workaround, restrict access to the "show matchs.php" and "persons.php" scripts to minimize the risk of exploitation. Avoid using the day and pageno parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-2926

Affected Products

Php Competition System

References · 4

• 🔥 https://exploit-db.com/exploits/9438 · Exploit
• 🔥 http://exploit-db.com/exploits/9438 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2926 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52487 · Note