Lucene search

[email protected]CVE-2005-3796

HistoryNov 24, 2005 - 11:03 a.m.

CVE-2005-3796

2005-11-2411:03:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2005-3796

code injection

alstrasoft affiliate network pro

vulnerability

admin_options_manage.php

nvd

8.3 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.008 Low

EPSS

Percentile

81.8%

JSON

Direct static code injection vulnerability in admin_options_manage.php in AlstraSoft Affiliate Network Pro 7.2 allows attackers to execute arbitrary PHP code via the number parameter. NOTE: it is not clear from the original report whether administrator privileges are required. If not, then this does not cross privilege boundaries and is not a vulnerability.

CPENameOperatorVersion
alstrasoft:affiliate_network_proalstrasoft affiliate network proeq7.2

CPE	Name	Operator	Version
alstrasoft:affiliate_network_pro	alstrasoft affiliate network pro	eq	7.2

References

marc.info/?l=bugtraq&m=113209435819541&w=2

myblog.it-security23.net/?postid=5

secunia.com/advisories/17605/

securityreason.com/securityalert/184

www.osvdb.org/20890

www.vupen.com/english/advisories/2005/2455

exchange.xforce.ibmcloud.com/vulnerabilities/23076

8.3 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.008 Low

EPSS

Percentile

81.8%

JSON

Related for CVE-2005-3796

cvelist1