PT-2010-2768 · Masa2El · Masa2El Music City

Alnjm33 · Published 2010-03-22 · Updated 2017-08-17 · CVE-2010-1047

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MASA2EL Music City versions 1.0 through 1.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter in a "singer" action, specifically targeting the index.php file.

Recommendations For versions 1.0 and 1.1, consider restricting access to the index.php file until a patch is available. As a temporary workaround, avoid using the id parameter in the singer action to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2010-1047

Affected Products

Masa2El Music City

References · 7

• 🔥 http://exploit-db.com/exploits/11329 · Exploit
• 🔥 https://exploit-db.com/exploits/11329 · Exploit
• 🔥 http://packetstormsecurity.org/1002-exploits/masa2elmc-sql.txt · Exploit
• http://secunia.com/advisories/38469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1047 · Security Note
• http://osvdb.org/62133 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56110 · Note