PT-2008-2817 · Bosclassifieds · Bosclassifieds Classified Ads System

Publicado 2008-03-10 · Atualizado 2017-08-08 · CVE-2008-1224

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions BosClassifieds Classified Ads System version 3.0

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the returnTo parameter in the account.php file.

Recommendations For BosClassifieds Classified Ads System version 3.0, avoid using the returnTo parameter in the account.php file until a fix is available. As a temporary workaround, consider restricting access to the account.php file to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-1224

Produtos afetados

Bosclassifieds Classified Ads System

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2008-1224 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41045 · Nota
• http://secunia.com/advisories/29261 · Aviso do Fabricante
• http://securityfocus.com/bid/28140 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1224 · Nota