PT-2008-5746 · Phorum · Phorum

Publicado 2008-10-09 · Atualizado 2017-08-08 · CVE-2008-4513

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Phorum version 5.2.8

Description: A cross-site scripting (XSS) issue exists due to the improper handling of nested BBcode image tags in the BBcode API module. This allows remote attackers to inject arbitrary web script or HTML.

Recommendations: For Phorum version 5.2.8, update the BBcode API module to a version that properly sanitizes nested BBcode image tags to prevent XSS attacks. As a temporary workaround, consider disabling the use of nested BBcode image tags in the BBcode API module until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-4513

Produtos afetados

Phorum

Referências · 8

• 🔥 http://trac.phorum.org/changeset/3528 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4513 · Nota
• http://secunia.com/advisories/32225 · Nota
• http://securityfocus.com/bid/31589 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45686 · Nota
• http://phorum.org/phorum5/read.php?64%2C133699 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4513 · Nota de Segurança
• http://nulledcore.com/?p=126 · Nota