PT-2023-9861 · Unknown · Web-Cyradm

Published 2023-01-08 · Updated 2024-05-17 · CVE-2007-10002

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions web-cyradm (affected versions not specified)

Description A critical issue has been found in web-cyradm, affecting some unknown functionality of the file auth.inc.php. The manipulation of the argument login/login password/LANG leads to sql injection. The attack may be launched remotely.

Recommendations To fix this issue, it is recommended to apply a patch with the name 2bcbead3bdb5f118bf2c38c541eaa73c29dcc90f. As a temporary workaround, consider restricting access to the auth.inc.php file until a patch is applied. Additionally, avoid using the login/login password/LANG argument in the affected functionality to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2007-10002

Affected Products

Web-Cyradm

References · 6

• https://github.com/web-cyradm/web-cyradm/commit/2bcbead3bdb5f118bf2c38c541eaa73c29dcc90f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-10002 · Security Note
• https://vuldb.com/?id.217640 · Note
• https://t.me/cvenotify/41520 · Telegram Post
• https://vuldb.com/?ctiid.217640 · Note
• https://t.me/cibsecurity/56135 · Telegram Post