PT-2009-5542 · Almondsoft · Almond Affiliate Network Classifieds+1

Published 2009-09-16 · Updated 2009-09-17 · CVE-2009-3226

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlmondSoft Almond Classifieds Ads Enterprise (affected versions not specified) Almond Affiliate Network Classifieds (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the replid parameter in a "manw repl add form" action in the index.php file.

Recommendations For AlmondSoft Almond Classifieds Ads Enterprise, avoid using the replid parameter in the "manw repl add form" action until the issue is resolved. For Almond Affiliate Network Classifieds, avoid using the replid parameter in the "manw repl add form" action until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-3226

Affected Products

Almond Affiliate Network Classifieds

Almond Classifieds Ads Enterprise

References · 5

• 🔥 http://securityfocus.com/bid/35816 · Exploit
• 🔥 https://exploit-db.com/exploits/33115 · Exploit
• 🔥 http://packetstormsecurity.org/0907-exploits/almondclassifiedsads-bsqlxss.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3226 · Security Note
• http://secunia.com/advisories/36003 · Vendor Advisory