PT-2009-2145 · Quickersite · Quickersite

Publicado 2009-04-08 · Atualizado 2017-08-17 · CVE-2008-6675

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions QuickerSite version 1.8.5

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various parameters and headers in different files, including the "close" parameter to "showThumb.aspx", "SB redirect" and "SB feedback" parameters in "process send.asp", "paramCode" and "cColor" parameters to "picker.asp", and the query string, Referer header, and X-FORWARDED-FOR header to "rss.asp".

Recommendations For QuickerSite version 1.8.5, consider disabling or restricting access to the vulnerable parameters and files, such as the "close" parameter in "showThumb.aspx", "SB redirect" and "SB feedback" parameters in "process send.asp", "paramCode" and "cColor" parameters in "picker.asp", and the query string, Referer header, and X-FORWARDED-FOR header in "rss.asp", until a patch is available. Avoid using these parameters and headers in the affected files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-6675

Produtos afetados

Quickersite

Referências · 9

• 🔥 https://exploit-db.com/exploits/5733 · Exploit
• 🔥 http://bugreport.ir/39/exploit.htm · Exploit
• 🔥 http://bugreport.ir/index_39.htm · Exploit
• http://osvdb.org/46221 · Nota
• http://secunia.com/advisories/30501 · Aviso do Fabricante
• http://securityfocus.com/bid/29524 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6675 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-6675 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42860 · Nota