PT-2007-7323 · Falcon · Falcon Series One Cms

Mhz91 · Publicado 2007-12-20 · Atualizado 2017-09-29 · CVE-2007-6489

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Falcon Series One CMS version 1.4.3

Description The issue allows remote attackers to inject arbitrary web script or HTML via the gb mail, gb name, and gb text parameters in a guestbook action to "index.php", and unspecified other vectors. This can lead to cross-site scripting (XSS) attacks.

Recommendations For Falcon Series One CMS version 1.4.3, as a temporary workaround, consider restricting access to the guestbook action in "index.php" and avoid using the gb mail, gb name, and gb text parameters until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Identificadores relacionados

CVE-2007-6489

Produtos afetados

Falcon Series One Cms

Referências · 5

• 🔥 https://exploit-db.com/exploits/4712 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6489 · Nota de Segurança
• http://osvdb.org/40987 · Nota
• http://vupen.com/english/advisories/2007/4173 · Nota
• http://secunia.com/advisories/28047 · Aviso do Fabricante