PT-2010-3253 · Taskfreak!+1 · Taskfreak!+1

Published 2010-05-05 · Updated 2017-08-17 · CVE-2010-1583

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tirzen Framework version 1.5 TaskFreak! versions prior to 0.6.3

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the username field in a login action, exploiting a SQL injection vulnerability in the loadByKey function in the TznDbConnection class in tzn mysql.php.

Recommendations For Tirzen Framework version 1.5, update to a version that fixes the SQL injection vulnerability in the loadByKey function. For TaskFreak! versions prior to 0.6.3, update to version 0.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the loadByKey function in the TznDbConnection class until a patch is available.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2010-1583

Affected Products

Taskfreak!

Tirzen Framework

References · 8

• 🔥 http://exploit-db.com/exploits/12452 · Exploit
• 🔥 https://exploit-db.com/exploits/12452 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-1583 · Security Note
• http://securityfocus.com/bid/39793 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1583 · Note
• http://taskfreak.com/versions.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58241 · Note
• http://madirish.net/?article=456 · Note