PT-2009-1799 · Softbiz · Softbiz Classifieds Script
Publicado
2009-02-27
·
Atualizado
2017-08-17
·
CVE-2008-6325
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
Softbiz Classifieds Script (affected versions not specified)
Description:
The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via several parameters, including the
radio parameter to "showcategory.php", "gallery.php", and the msg parameter to various files such as "advertisers/signinform.php", "lostpassword.php", "admin/adminhome.php", and "admin/index.php".Recommendations:
For the "showcategory.php" file, consider restricting access to the
radio parameter until a fix is available.
For the "advertisers/signinform.php" file, avoid using the msg parameter in the affected endpoint until the issue is resolved.
For the "gallery.php" file, restrict access to the radio parameter as a temporary workaround.
For the "lostpassword.php" file, avoid using the msg parameter until a patch is available.
For the "admin/adminhome.php" and "admin/index.php" files, restrict access to the msg parameter to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Softbiz Classifieds Script