PT-2005-4933 · Snipe · Snipe Gallery

Qex · Publicado 2005-12-14 · Atualizado 2011-03-08 · CVE-2005-4245

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Snipe Gallery versions 3.1.4 and earlier

Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the keyword parameter in the "search.php" endpoint.

Recommendations For Snipe Gallery versions 3.1.4 and earlier, update to a version later than 3.1.4 to resolve the issue. As a temporary workaround, consider restricting access to the search.php endpoint or sanitizing the keyword parameter to prevent malicious input.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2005-4245

Produtos afetados

Snipe Gallery

Referências · 8

• 🔥 http://pridels0.blogspot.com/2005/12/snipe-gallery-sqlxss-vuln.html · Exploit
• 🔥 http://securityfocus.com/bid/15844 · Exploit
• 🔥 http://securityreason.com/securityalert/716 · Exploit
• 🔥 https://exploit-db.com/exploits/26801 · Exploit
• http://osvdb.org/21695 · Nota
• http://secunia.com/advisories/18022 · Aviso do Fabricante
• http://vupen.com/english/advisories/2005/2882 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4245 · Nota de Segurança