NVD Vulnerability Detail

CVE-2010-4780

Summary	SQL injection vulnerability in the check_banlist function in includes/sessions.php in Enano CMS 1.1.7pl1; 1.0.6pl2; and possibly other versions before 1.1.8, 1.0.6pl3, and 1.1.7pl2 allows remote attackers to execute arbitrary SQL commands via the email parameter to index.php. NOTE: some of these details are obtained from third party information.
Publication Date	April 7, 2011, 11:23 p.m.
Registration Date	Jan. 29, 2021, 11:10 a.m.
Last Update	Nov. 21, 2024, 10:21 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://enanocms.org/News:Article/2010/11/16/Enano_1.1.8.2c_1.0.6pl3.2c_and_1.1.7pl2_released
2	http://osvdb.org/69537
3	http://packetstormsecurity.org/files/view/96229/enanocms-sqldisclose.txt	Exploit
4	http://secunia.com/advisories/42375	Vendor Advisory
5	http://securityreason.com/securityalert/8183
6	http://www.exploit-db.com/exploits/15645	Exploit
7	http://www.htbridge.ch/advisory/sql_injection_in_enano_cms.html	Exploit
8	http://www.securityfocus.com/bid/45120	Exploit
9	http://enanocms.org/News:Article/2010/11/16/Enano_1.1.8.2c_1.0.6pl3.2c_and_1.1.7pl2_released
10	http://www.securityfocus.com/bid/45120	Exploit
11	http://www.htbridge.ch/advisory/sql_injection_in_enano_cms.html	Exploit
12	http://www.exploit-db.com/exploits/15645	Exploit
13	http://securityreason.com/securityalert/8183
14	http://secunia.com/advisories/42375	Vendor Advisory
15	http://packetstormsecurity.org/files/view/96229/enanocms-sqldisclose.txt	Exploit
16	http://osvdb.org/69537

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-89	SQLインジェクション	https://cwe.mitre.org/data/definitions/89.html

JVN Vulnerability Information

Enano CMS の check_banlist 関数における SQL インジェクションの脆弱性

Title	Enano CMS の check_banlist 関数における SQL インジェクションの脆弱性
Summary	Enano CMS の includes/sessions.php の check_banlist 関数には、SQL インジェクションの脆弱性が存在します。
Possible impacts	第三者により、index.php への email パラメータを介して、任意の SQL コマンドを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 7, 2011, midnight
Registration Date	March 27, 2012, 6:42 p.m.
Last Update	March 27, 2012, 6:42 p.m.

Affected System

enanocms

enano cms 1.1.7pl1、1.0.6pl2、1.1.8 および 1.0.6pl3 および 1.1.7pl2 未満のその他のバージョン

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-4780	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4780
National Vulnerability Database (NVD)
2	CVE-2010-4780	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4780

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
enanocms
1	Enano 1.1.8, 1.0.6pl3, and 1.1.7pl2 released	http://enanocms.org/News:Article/2010/11/16/Enano_1.1.8.2c_1.0.6pl3.2c_and_1.1.7pl2_released

Change Log

No	Changed Details	Date of change
0	[2012年03月27日] 掲載	Feb. 17, 2018, 10:37 a.m.