CVE-2010-1583
published 2010-05-06CVE-2010-1583: SQL injection vulnerability in the loadByKey function in the TznDbConnection class in tzn_mysql.php in Tirzen (aka TZN) Framework 1.5, as used in TaskFreak!…
PriorityP347high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
2.04%
78.7th percentile
SQL injection vulnerability in the loadByKey function in the TznDbConnection class in tzn_mysql.php in Tirzen (aka TZN) Framework 1.5, as used in TaskFreak! before 0.6.3, allows remote attackers to execute arbitrary SQL commands via the username field in a login action.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| taskfreak | taskfreak_! | <= 0.6.2 | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| taskfreak | taskfreak_! | — | — |
| tirzen | tirzen_framework | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Solaris LPD - Command Execution (Metasploit)
exploitdb·2010-09-20
CVE-2001-1583 Solaris LPD - Command Execution (Metasploit)
Solaris LPD - Command Execution (Metasploit)
---
##
# $Id: sendmail_exec.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Solaris LPD Command Execution',
'Description' => %q{
This module exploits an arbitrary command execution flaw in
the in.lpd service shipped with all versions of Sun Solaris
up to and including 8.0. This module uses a technique
discovered by Dino Dai Zovi to exploit the flaw without
needing to know the resolved name of the attacking system.
},
'Author' => [ 'hdm', 'ddz' ],
'License' =>
Exploit-DB
TaskFreak 0.6.2 - SQL Injection
exploitdb·2010-04-29·CVSS 7.5
CVE-2010-1583 [HIGH] TaskFreak 0.6.2 - SQL Injection
TaskFreak 0.6.2 - SQL Injection
---
CVE-2010-1583
Vendor notified and product update released.
Details of this report are also available at
http://www.madirish.net/?article=456
Description of Vulnerability:
- ------------------------------
The Tirzen Framework (http://www.tirzen.net/tzn/) is a supporting API
developed by Tirzen (http://www.tirzen.com), an intranet and internet
solutions provider. The Tirzen Framework contains a SQL injection
vulnerability (http://www.owasp.org/index.php/SQL_Injection). This
vulnerability could allow an attacker to arbitrarily manipulate SQL strings
constructed using the library. This vulnerability manifests itself most
notably in the Task Freak (http://www.taskfreak.com/) open source task
management software. The vulnerability can be exploited to byp
No writeups or analysis indexed.
http://www.exploit-db.com/exploits/12452http://www.madirish.net/?article=456http://www.securityfocus.com/bid/39793http://www.taskfreak.com/versions.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/58241http://www.exploit-db.com/exploits/12452http://www.madirish.net/?article=456http://www.securityfocus.com/bid/39793http://www.taskfreak.com/versions.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/58241
2010-05-06
Published