PT-2008-5032 · Xoops · Yogurt Social Network

Publicado 2008-08-13 · Atualizado 2017-08-08 · CVE-2008-3668

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Yogurt Social Network module version 3.2 rc1 for XOOPS

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via the uid parameter to various API endpoints, including "friends.php", "seutubo.php", "album.php", "scrapbook.php", "index.php", or "tribes.php", or through the description field of a new scrap.

Recommendations For Yogurt Social Network module version 3.2 rc1, consider disabling the affected API endpoints ("friends.php", "seutubo.php", "album.php", "scrapbook.php", "index.php", "tribes.php") and restricting access to the description field of new scraps until a patch is available. Avoid using the uid parameter in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-3668

Produtos afetados

Yogurt Social Network

Referências · 12

• 🔥 https://exploit-db.com/exploits/32203 · Exploit
• 🔥 https://exploit-db.com/exploits/32201 · Exploit
• 🔥 https://exploit-db.com/exploits/32200 · Exploit
• 🔥 https://exploit-db.com/exploits/32199 · Exploit
• 🔥 https://exploit-db.com/exploits/32202 · Exploit
• 🔥 https://exploit-db.com/exploits/32198 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3668 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44387 · Nota
• http://securityfocus.com/bid/30618 · Nota
• http://lostmon.blogspot.com/2008/08/yogurt-social-network-multiple-scripts.html · Nota
• http://securityfocus.com/bid/30619 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44385 · Nota