PT-2022-11631 · Unknown · Pacman-Canvas

Published 2022-12-19 · Updated 2022-12-27 · CVE-2021-4261

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pacman-canvas versions up to 1.0.5

Description A critical vulnerability has been found in pacman-canvas, affecting the addHighscore function of the file data/db-handler.php. This vulnerability leads to sql injection and can be launched remotely.

Recommendations For versions up to 1.0.5, upgrade to version 1.0.6 to address this issue. As a temporary workaround, consider disabling the addHighscore function until the patch is applied. Restrict access to the data/db-handler.php file to minimize the risk of exploitation.

Fix

Improper Neutralization

SQL injection

Weakness Enumeration

CWE-707

CWE-89

Related Identifiers

CVE-2021-4261

Affected Products

Pacman-Canvas

References · 7

• https://github.com/platzhersh/pacman-canvas/commit/29522c90ca1cebfce6453a5af5a45281d99b0646 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-4261 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4261 · Vendor Advisory
• https://github.com/platzhersh/pacman-canvas/releases/tag/1.0.6 · Note
• https://t.me/cibsecurity/54855 · Telegram Post
• https://vuldb.com/?id.216270 · Note
• https://t.me/cvenotify/40176 · Telegram Post