PT-2009-5575 · Livestreet · Livestreet
Published
2009-09-18
·
Updated
2009-09-22
·
CVE-2009-3261
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
LiveStreet version 0.2
Description
The issue allows remote attackers to perform DROP TABLE operations without requiring administrative authentication. This is due to a lack of authentication in the update/update 0.1.2 to 0.2.php file.
Recommendations
For LiveStreet version 0.2, consider restricting access to the update/update 0.1.2 to 0.2.php file until a proper authentication mechanism is implemented to prevent unauthorized DROP TABLE operations.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Livestreet