PT-2005-2751 · Unknown · Bookreview

Lostmon · Publicado 2005-05-31 · Atualizado 2008-09-10 · CVE-2005-1783

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BookReview version 1.0

Description The issue allows remote attackers to obtain the path of the web server via certain parameters to "search.htm". This is possibly due to a search[string] parameter with a missing value or an incorrect submit[type] value, which reveals the path in the resulting error message.

Recommendations For BookReview version 1.0, as a temporary workaround, consider restricting access to the "search.htm" endpoint until a patch is available. Avoid using the search[string] parameter and submit[type] value in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2005-1783

Produtos afetados

Bookreview

Referências · 5

• 🔥 http://lostmon.blogspot.com/2005/05/bookreview-10-multiple-variable-xss.html · Exploit
• 🔥 http://osvdb.org/16881 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1783 · Nota de Segurança
• http://secunia.com/advisories/1014058 · Nota
• http://osvdb.org/16880 · Nota