PT-2008-4427 · Phpeasydata · Phpeasydata

Sylvain Thual · Publicado 2008-07-03 · Atualizado 2018-10-11 · CVE-2008-2994

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHPEasyData version 1.5.4

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via the annuaire parameter to "last records.php" and "annuaire.php", as well as the by and cat id parameters to "annuaire.php".

Recommendations For PHPEasyData version 1.5.4, consider validating and sanitizing user input for the annuaire, by, and cat id parameters in the affected scripts to prevent arbitrary script or HTML injection. As a temporary workaround, restrict access to the "last records.php" and "annuaire.php" scripts until a proper fix is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-2994

Produtos afetados

Phpeasydata

Referências · 7

• 🔥 https://exploit-db.com/exploits/31907 · Exploit
• 🔥 http://securityfocus.com/bid/29659 · Exploit
• 🔥 https://exploit-db.com/exploits/31906 · Exploit
• http://securityfocus.com/archive/1/493273/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42997 · Nota
• http://securityreason.com/securityalert/3969 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2994 · Nota de Segurança