PT-2003-2230 · Sambar · Sambar Server

Publicado 2003-12-31 · Atualizado 2017-07-11 · CVE-2003-1285

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sambar Server versions prior to 6.0 beta 6

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. This can be achieved via the query string to various API endpoints and scripts, including (1) isapi/testisa.dll, (2) testcgi.exe, (3) environ.pl, (4) the query parameter to samples/search.dll, (5) the price parameter to mortgage.pl, (6) the query string in dumpenv.pl, (7) the query string to dumpenv.pl, and (8) the E-Mail field of the guestbook script (book.pl).

Recommendations For Sambar Server versions prior to 6.0 beta 6, update to version 6.0 beta 6 or later to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2003-1285

Produtos afetados

Sambar Server

Referências · 13

• 🔥 http://osvdb.org/5784 · Exploit
• 🔥 http://osvdb.org/5782 · Exploit
• 🔥 http://osvdb.org/5783 · Exploit
• 🔥 http://osvdb.org/5805 · Exploit
• 🔥 http://osvdb.org/5785 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1285 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13305 · Nota
• http://idefense.com/application/poi/display?id=103&type=vulnerabilities&flashstatus=true · Aviso do Fabricante
• http://sambar.com/security.htm · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1285 · Nota
• http://securitytracker.com/id?1007819 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16056 · Nota
• http://secunia.com/advisories/9578 · Correção