File Store PRO 3.2 - Multiple Blind SQL Injection

admin

0
文章

0
评论

2023-12-15 00:40:40 Ali_nvd 来源：ZONE.CI 全球网 0 阅读模式

File Store PRO 3.2 - Multiple Blind SQL Injection

CVE编号

CVE-2006-1278

利用情况

暂无

补丁情况

N/A

披露时间

2006-03-20

漏洞描述

SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) functions.php and (2) user.php in the libs directory, (3) edit.php and (4) delete.php in control/files/, (5) edit.php and (6) delete.php in control/users/, (7) edit.php, (8) access.php, and (9) in control/folders/, (10) access.php and (11) delete.php in control/groups/, (12) confirm.php, and (13) download.php; (14) the email parameter in password.php, and (15) the id parameter in folder.php. NOTE: it was later reported that vectors 12 and 13 also affect @1 File Store PRO 3.2.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://evuln.com/vulns/95/summary.html
http://osvdb.org/47017
http://osvdb.org/47018
http://secunia.com/advisories/19224
http://secunia.com/advisories/31063
http://securityreason.com/securityalert/619
http://securitytracker.com/id?1015826
http://www.attrition.org/pipermail/vim/2009-August/002246.html
http://www.osvdb.org/23851
http://www.osvdb.org/23852
http://www.osvdb.org/23853
http://www.osvdb.org/23854
http://www.osvdb.org/23855
http://www.osvdb.org/23856
http://www.osvdb.org/23857
http://www.osvdb.org/23858
http://www.osvdb.org/23859
http://www.osvdb.org/23860
http://www.osvdb.org/23861
http://www.osvdb.org/23862
http://www.osvdb.org/23863
http://www.osvdb.org/23864
http://www.osvdb.org/24106
http://www.securityfocus.com/archive/1/428659/100/0/threaded
http://www.securityfocus.com/bid/17090
http://www.securityfocus.com/bid/30182
http://www.vupen.com/english/advisories/2006/0943
https://exchange.xforce.ibmcloud.com/vulnerabilities/25183
https://exchange.xforce.ibmcloud.com/vulnerabilities/43718
https://exchange.xforce.ibmcloud.com/vulnerabilities/43724
https://www.exploit-db.com/exploits/6040