PT-2008-4199 · Xigla · Xigla Absolute Form Processor Xe

Publicado

2008-06-18

·

Atualizado

2017-08-08

·

CVE-2008-2759

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Xigla Absolute Form Processor XE version 4.0
Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the showfields, text, and submissions parameters to the "search.asp" endpoint, as well as the name parameter to the "users.asp" endpoint.
Recommendations For Xigla Absolute Form Processor XE version 4.0, consider restricting access to the search.asp and users.asp endpoints until a fix is available. As a temporary workaround, avoid using the showfields, text, submissions, and name parameters in these endpoints to minimize the risk of exploitation.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-2759

Produtos afetados

Xigla Absolute Form Processor Xe