PT-2010-2373 · Evalsmsi · Evalsmsi

Published 2010-02-11 · Updated 2018-10-10 · CVE-2010-0616

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions evalSMSI version 2.1.03

Description The issue allows attackers with database access to gain privileges by leveraging stored passwords in cleartext. Remote attack vectors are possible by leveraging a separate SQL injection vulnerability.

Recommendations For evalSMSI version 2.1.03, consider updating the password storage mechanism to a more secure method, such as hashing and salting, to prevent unauthorized access. As a temporary workaround, restrict database access to minimize the risk of exploitation. Additionally, address the separate SQL injection vulnerability to prevent remote attacks.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2010-0616

Affected Products

Evalsmsi

References · 7

• 🔥 http://securityfocus.com/bid/38116 · Exploit
• 🔥 http://packetstormsecurity.org/1002-exploits/corelan-10-008-evalmsi.txt · Exploit
• http://secunia.com/advisories/38478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0616 · Security Note
• http://osvdb.org/62180 · Note
• http://corelan.be:8800/index.php/forum/security-advisories/corelan-10-008-evalmsi-2-1-03-multiple-vulnerabilities · Note
• http://securityfocus.com/archive/1/509370/100/0/threaded · Note