PT-2007-5712 · Olate · Olate Download

Imei Addmimistrator · Publicado 2007-08-27 · Atualizado 2018-10-15 · CVE-2007-4541

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Olate Download (od) version 3.4.2

Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible via the PHP SELF variable in modules/core/uim.php and [url] tags in a comment in modules/core/fldm.php.

Recommendations For Olate Download (od) version 3.4.2, consider disabling the uim.php and fldm.php modules until a patch is available to prevent exploitation. Restrict access to these modules to minimize the risk of XSS attacks. Avoid using the PHP SELF variable in uim.php and [url] tags in comments in fldm.php until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2007-4541

Produtos afetados

Olate Download

Referências · 12

• 🔥 http://securityfocus.com/bid/25412 · Exploit
• http://osvdb.org/39710 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4541 · Nota de Segurança
• http://secunia.com/advisories/26565 · Aviso do Fabricante
• http://securityfocus.com/archive/1/477338/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36196 · Nota
• http://myimei.com/security/2007-08-22/olate-download-342modulescoreuimphpxss.html · Nota
• http://osvdb.org/39711 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36197 · Nota
• http://securityreason.com/securityalert/3076 · Nota
• http://myimei.com/security/2007-08-22/olate-download-342modulescorefldmphpcomments-tag-url-xss.html · Nota
• http://securityfocus.com/archive/1/477337/100/0/threaded · Nota