PT-2010-1785 · Irokez · Irokez Cms

Ins3T · Published 2010-08-25 · Updated 2017-09-19 · CVE-2009-4982

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Irokez CMS version 0.7.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible due to a SQL injection vulnerability in the select function when magic quotes gpc is disabled. The vulnerability can be exploited via the PATH INFO to the default URI.

Recommendations For Irokez CMS version 0.7.1, consider disabling the select function or restricting access to it until a patch is available. Additionally, enabling magic quotes gpc can help mitigate the risk of SQL injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-4982

Affected Products

Irokez Cms

References · 6

• 🔥 http://securityfocus.com/bid/35957 · Exploit
• 🔥 https://exploit-db.com/exploits/9369 · Exploit
• 🔥 http://exploit-db.com/exploits/9369 · Exploit
• http://secunia.com/advisories/23497 · Vendor Advisory
• http://vupen.com/english/advisories/2009/2167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4982 · Security Note