PT-2010-4954

CVE-2010-3608

·

Publicado

2010-09-24

·

Atualizado

2010-09-27

Descrição por

CVSS 2.0
7.5
Alta
MétricasAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions wpQuiz version 2.7
Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the id and password (pw) parameters to "admin.php" or "user.php" API endpoints.
Recommendations For wpQuiz version 2.7, consider restricting access to the "admin.php" and "user.php" API endpoints until a patch is available. As a temporary workaround, avoid using the id and password (pw) parameters in these endpoints to minimize the risk of exploitation.
Explorabilidade
Exploit
Correção
Impactos
Pesquisadores
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Identificadores relacionados
CVE-2010-3608
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com