PT-2010-4837

CVE-2010-3467

Publicado

2010-09-17

Atualizado

2017-08-17

Descrição por

CVSS 2.0

6.8

Média

MétricasAV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions E-Xoopport Samsara versions 3.1 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the secid parameter in a "listarticles" action when the Tutorial module is enabled.

Recommendations For E-Xoopport Samsara versions 3.1 and earlier, consider disabling the Tutorial module until a patch is available. Avoid using the secid parameter in the affected API endpoint until the issue is resolved.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Dante90

Mrkz

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Identificadores relacionados