PT-2004-2913 · Unknown · Turbo Traffic Trader C
Publicado
2004-12-31
·
Atualizado
2017-07-11
·
CVE-2004-2017
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Turbo Traffic Trader C (TTT-C) version 1.0
Description
The issue allows remote attackers to inject arbitrary HTML or web script via multiple vectors, including the
link parameter to "ttt-out", the X-Forwarded-For header in a GET request to "ttt-in", the Referer header in a GET request to "ttt-in", or the site name or site URL fields in the main control panel.Recommendations
For Turbo Traffic Trader C (TTT-C) version 1.0, consider disabling the
link parameter in "ttt-out", restricting access to the "ttt-in" endpoint, and limiting user input in the site name and site URL fields until a patch is available. Additionally, as a temporary workaround, restrict the use of the X-Forwarded-For and Referer headers in GET requests to "ttt-in".Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Turbo Traffic Trader C