PT-2008-2937 · Myiosoft · Myiosoft Easygallery

Joss · Publicado 2008-03-17 · Atualizado 2018-10-11 · CVE-2008-1347

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MyioSoft EasyGallery versions 5.0tr and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO or the q parameter in an about action to the help system, potentially leading to cross-site scripting (XSS) attacks.

Recommendations For MyioSoft EasyGallery versions 5.0tr and earlier, update to a version later than 5.0tr to resolve the issue. As a temporary workaround, consider restricting access to the staticpages/easygallery/index.php file and the help system to minimize the risk of exploitation. Avoid using the q parameter in the about action to the help system until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-1347

Produtos afetados

Myiosoft Easygallery

Referências · 6

• 🔥 https://exploit-db.com/exploits/5247 · Exploit
• 🔥 http://securityfocus.com/bid/28233 · Exploit
• http://secunia.com/advisories/29372 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41186 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1347 · Nota de Segurança
• http://securityfocus.com/archive/1/489583/100/0/threaded · Nota