PT-2005-4936 · Quickpaypro · Quickpaypro

Publicado 2005-12-15 · Atualizado 2011-03-08 · CVE-2005-4248

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions QuickPayPro version 3.1

Description The issue allows remote attackers to inject arbitrary web script or HTML via various fields. Specifically, the affected API endpoints include "communication/subscribers.tracking.add.php", "support/tickets.add.php", and "mycompany/categories.php".

Recommendations For QuickPayPro version 3.1, consider disabling access to the affected endpoints "communication/subscribers.tracking.add.php", "support/tickets.add.php", and "mycompany/categories.php" until a patch is available. Restrict input validation for fields in these endpoints to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-4248

Produtos afetados

Quickpaypro

Referências · 8

• http://secunia.com/advisories/17981 · Aviso do Fabricante
• http://pridels0.blogspot.com/2005/12/quickpaypro-31-multiple-vuln.html · Nota
• http://osvdb.org/21683 · Nota
• http://securityfocus.com/bid/15863 · Nota
• http://osvdb.org/21684 · Nota
• http://vupen.com/english/advisories/2005/2875 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4248 · Nota de Segurança
• http://osvdb.org/21682 · Nota