PT-2009-2487 · Nashtech · Nashtech Easy Php Calendar

Publicado 2009-08-21 · Atualizado 2017-08-17 · CVE-2008-7018

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NashTech Easy PHP Calendar version 6.3.25

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the descr parameter in the Details field of an Add New Event action. This occurs in an unspecified request generated by an add action in index.php.

Recommendations For NashTech Easy PHP Calendar version 6.3.25, consider validating and sanitizing user input for the descr parameter to prevent XSS attacks. As a temporary workaround, restrict access to the Add New Event action in index.php to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-7018

Produtos afetados

Nashtech Easy Php Calendar

Referências · 4

• http://securityfocus.com/bid/31478 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45517 · Nota
• http://securityfocus.com/archive/1/496796 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-7018 · Nota de Segurança