PT-2009-5786 · Unknown · T-Htb Manager

Drosophila + 1 · Published 2009-09-30 · Updated 2018-10-10 · CVE-2009-3494

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions T-HTB Manager version 0.5

Description The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities in index.php. This is possible when magic quotes gpc is disabled, and attackers can exploit it via various parameters, including the id parameter in a delete category action and the name parameter in an update category action.

Recommendations For T-HTB Manager version 0.5, consider disabling the delete category and update category actions until a patch is available, and ensure magic quotes gpc is enabled to prevent SQL injection attacks. Restrict access to the index.php file to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-3494

Affected Products

T-Htb Manager

References · 5

• 🔥 http://exploit-db.com/exploits/9637 · Exploit
• 🔥 https://exploit-db.com/exploits/9637 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3494 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53145 · Note
• http://securityfocus.com/archive/1/506386/100/0/threaded · Note