PT-2010-1646 · Basic Analysis Security Engine · Base

Published 2010-05-05 · Updated 2012-07-03 · CVE-2009-4838

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Basic Analysis and Security Engine (BASE) versions prior to 1.4.3.1

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. The issue is related to the base ag common.php file and involves unspecified parameters.

Recommendations For versions prior to 1.4.3.1, update to version 1.4.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the base ag common.php file to minimize the risk of exploitation. Avoid using unspecified parameters in the affected file until the issue is resolved.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-4838

Affected Products

Base

References · 5

• http://secunia.com/advisories/35222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4838 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4838 · Note
• http://base.secureideas.net/news.php · Note
• http://secureideas.cvs.sourceforge.net/viewvc/secureideas/base-php4/base_ag_common.php?sortby=date&view · Note