PT-2024-10604 · Unknown · Lunad3V Areaload

Published 2024-10-29 · Updated 2024-10-29 · CVE-2017-20195

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Medium

Base vector

AV:A/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LUNAD3v AreaLoad up to 1a1103182ed63a06dde63d1712f3262eda19c3ec

Description A critical issue affects the processing of the file request.php, where the manipulation of the phone argument leads to sql injection. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations Apply the patch named 264813c546dba03989ac0fc365f2022bf65e3be2 to fix this issue. As a temporary workaround, consider restricting the use of the phone argument in the request.php file until the patch is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-20195

Affected Products

Lunad3V Areaload

References · 7

• https://github.com/LUNAD3v/areaload/commit/264813c546dba03989ac0fc365f2022bf65e3be2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-20195 · Security Note
• https://osv.dev/vulnerability/CVE-2017-20195 · Vendor Advisory
• https://t.me/cvenotify/99842 · Telegram Post
• https://vuldb.com/?ctiid.281987 · Note
• https://t.me/cvedetector/9309 · Telegram Post
• https://vuldb.com/?id.281987 · Note