PT-2009-3855

CVE-2009-1323

Publicado

2009-04-17

Atualizado

2017-09-29

Descrição por

CVSS 2.0

7.5

Alta

MétricasAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Web File Explorer version 3.1

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the id parameter in the "body.asp" file.

Recommendations For Web File Explorer version 3.1, avoid using the id parameter in the body.asp file until a fix is available. Consider restricting access to the body.asp file to minimize the risk of exploitation.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Giovanni Buzzin

Osirys

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Identificadores relacionados