PT-2007-4607 · Stphp · Stphp Easynews Pro

Publicado 2007-06-21 · Atualizado 2017-07-29 · CVE-2007-3330

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions STphp EasyNews PRO version 4.0

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a news post. The news post is stored in the news/ directory without proper sanitization, enabling the execution of malicious scripts.

Recommendations For STphp EasyNews PRO version 4.0, ensure that all user input, especially news posts, is properly sanitized before being stored or displayed to prevent the injection of malicious scripts. As a temporary workaround, consider disabling the news posting feature until a proper fix is implemented to sanitize user input.

Correção

Identificadores relacionados

CVE-2007-3330

Produtos afetados

Stphp Easynews Pro

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-3330 · Nota de Segurança
• http://osvdb.org/36472 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34892 · Nota
• http://securityreason.com/securityalert/2829 · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/064051.html · Nota
• http://securityfocus.com/bid/24512 · Nota