PT-2010-2809 · 1024 · 1024 Cms

Published 2010-03-24 · Updated 2010-12-14 · CVE-2010-1093

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 1024 CMS version 2.1.1

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is possible when the magic quotes gpc setting is disabled. The issue can be exploited via the id parameter in a vp action.

Recommendations For 1024 CMS version 2.1.1, consider disabling the vp action or restricting access to the rss.php file until a patch is available. Additionally, enabling magic quotes gpc can help mitigate this issue.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2010-1093

Affected Products

1024 Cms

References · 6

• 🔥 https://exploit-db.com/exploits/14942 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-1093 · Security Note
• http://secunia.com/advisories/38775 · Vendor Advisory
• http://bugreport.ir/index_69.htm · Note
• http://securityfocus.com/bid/38476 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1093 · Note