PT-2010-5509

CVE-2010-4505

·

Published

2010-12-08

·

Updated

2010-12-09

Description by

CVSS 2.0
6.8
Medium
MetricsAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Injader version 2.4.4
Description The issue concerns SQL injection vulnerabilities in the login.php file. When magic quotes gpc is disabled, remote attackers can execute arbitrary SQL commands via the un and pw parameters in the login functionality.
Recommendations For Injader version 2.4.4, consider disabling the login functionality until a patch is available, or ensure that magic quotes gpc is enabled to mitigate the risk of SQL injection attacks.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2010-4505
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com