PT-2012-5569 · Zeroboard · Siche Search Module

Snup · Published 2012-08-31 · Updated 2017-08-29 · CVE-2012-4743

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Siche search module version 0.5 for Zeroboard

Description The issue concerns SQL injection vulnerabilities in the ssearch.php file of the Siche search module. Remote attackers can execute arbitrary SQL commands by manipulating certain parameters. The vulnerable parameters include ss, sm, align, and category.

Recommendations For Siche search module version 0.5, consider restricting access to the ssearch.php file until a patch is available, and avoid using the ss, sm, align, and category parameters in the affected API endpoint. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2012-4743

Affected Products

Siche Search Module

References · 6

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-04/0099.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-4743 · Security Note
• http://vulnerability-lab.com/get_content.php?id=504 · Note
• http://osvdb.org/81178 · Note
• http://securityfocus.com/bid/53035 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74916 · Note