PT-2011-1943 · Brightsuite · Brightsuite Groupware

L0Rd Crusad3R · Published 2011-11-02 · Updated 2012-02-14 · CVE-2010-5008

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BrightSuite Groupware version 5.4

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. The issue is exploited via the ContactID parameter in the "pages/contact list mail form.asp" page.

Recommendations For BrightSuite Groupware version 5.4, update the software to a version that fixes this issue, or as a temporary workaround, consider restricting access to the "pages/contact list mail form.asp" page to minimize the risk of exploitation. Avoid using the ContactID parameter in the affected page until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2010-5008

Affected Products

Brightsuite Groupware

References · 7

• 🔥 http://packetstormsecurity.org/1006-exploits/brightsuite-sql.txt · Exploit
• 🔥 http://exploit-db.com/exploits/13843 · Exploit
• 🔥 https://exploit-db.com/exploits/13843 · Exploit
• 🔥 http://securityfocus.com/bid/40845 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-5008 · Security Note
• http://vupen.com/english/advisories/2010/1459 · Vendor Advisory
• http://securityreason.com/securityalert/8507 · Note