PT-2013-5481 · Alienvault · Alienvault Ossim

Glafkos Charalambous · Published 2013-08-20 · Updated 2013-08-21 · CVE-2013-5321

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlienVault Open Source Security Information Management (OSSIM) version 4.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved through various parameters in different PHP files, including the sensor parameter in a Query action to "forensics/base qry main.php", the tcp flags[] or tcp port[0][4] parameters to "forensics/base stat alerts.php", the ip addr[1][8] or port type parameters to "forensics/base stat ports.php", or the sortby or rvalue parameters in a search action to "vulnmeter/index.php".

Recommendations For AlienVault Open Source Security Information Management (OSSIM) version 4.1, consider disabling the vulnerable parameters sensor, tcp flags[], tcp port[0][4], ip addr[1][8], port type, sortby, and rvalue in their respective PHP files until a patch is available. Restrict access to the affected PHP files, such as "forensics/base qry main.php", "forensics/base stat alerts.php", "forensics/base stat ports.php", and "vulnmeter/index.php", to minimize the risk of exploitation.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2013-5321

Affected Products

Alienvault Ossim

References · 7

• 🔥 http://exploit-db.com/exploits/26406 · Exploit
• 🔥 https://exploit-db.com/exploits/26406 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-5321 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-5321 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-5321 · Security Note
• https://ubuntu.com/security/CVE-2013-5321 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5321 · Note