PT-2019-18525

CVE-2019-7316

Publicado

2019-02-04

Atualizado

2020-10-07

Descrição por

CVSS 3.1

9.8

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CSS-TRICKS Chat2 versions through 2015-05-05

Description An issue was discovered in the software, where the userid parameter in the "jumpin.php" endpoint has a SQL injection issue.

Recommendations For CSS-TRICKS Chat2 versions through 2015-05-05, avoid using the userid parameter in the "jumpin.php" endpoint until the issue is resolved. Consider restricting access to the "jumpin.php" endpoint to minimize the risk of exploitation.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Eddie Tc Chang

Yu-Hsiang Huang

Yung-Hao Tseng

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')