PT-2008-3331 · Smart · Smart Photo Ads+2

Publicado 2008-04-15 · Atualizado 2017-08-08 · CVE-2008-1793

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Smart Classified ADS Professional (affected versions not specified) Smart Photo ADS (affected versions not specified) Smart Photo ADS Gold (affected versions not specified)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the AdNum and Department parameters in the view.cgi component.

Recommendations For Smart Classified ADS Professional, restrict access to the view.cgi component to minimize the risk of exploitation. For Smart Photo ADS, avoid using the AdNum and Department parameters in the view.cgi component until the issue is resolved. For Smart Photo ADS Gold, consider disabling the view.cgi component as a temporary workaround until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-1793

Produtos afetados

Smart Classified Ads Professional

Smart Photo Ads

Smart Photo Ads Gold

Referências · 4

• http://secunia.com/advisories/29623 · Aviso do Fabricante
• http://securityfocus.com/bid/28595 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1793 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41611 · Nota