PT-2013-4467 · Todoo · Todoo Forum

Published 2013-05-13 · Updated 2017-08-29 · CVE-2013-3537

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Todoo Forum version 2.0

Description The issue concerns SQL injection vulnerabilities in the todooforum.php file. Remote attackers can execute arbitrary SQL commands by manipulating the id post or pg parameters.

Recommendations For Todoo Forum version 2.0, update the todooforum.php file to properly sanitize the id post and pg parameters to prevent SQL injection attacks. As a temporary workaround, consider restricting access to the todooforum.php file until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2013-3537

Affected Products

Todoo Forum

References · 6

• 🔥 http://packetstormsecurity.com/files/121290/Todoo-Forum-2.0-Cross-Site-Scripting-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/38477 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-3537 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/83599 · Note
• http://securityfocus.com/bid/59069 · Note
• http://osvdb.org/92318 · Note