PT-2009-2602 · Easyimagecatalogue · Easyimagecatalogue

Publicado 2009-09-01 · Atualizado 2017-08-17 · CVE-2008-7133

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions EasyImageCatalogue version 1.3.1

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via several parameters, including the search and d index.php parameters to "index.php", the dir parameter to "thumber.php", and the d parameter to "describe.php" and "addcomment.php".

Recommendations For EasyImageCatalogue version 1.3.1, consider validating and sanitizing user input for the search, d, and dir parameters in the affected scripts to prevent arbitrary script or HTML injection. As a temporary workaround, restrict access to the vulnerable scripts until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-7133

Produtos afetados

Easyimagecatalogue

Referências · 8

• 🔥 https://exploit-db.com/exploits/31372 · Exploit
• 🔥 https://exploit-db.com/exploits/31373 · Exploit
• 🔥 http://securityfocus.com/bid/28164 · Exploit
• 🔥 https://exploit-db.com/exploits/31371 · Exploit
• 🔥 https://exploit-db.com/exploits/31374 · Exploit
• 🔥 http://downloads.securityfocus.com/vulnerabilities/exploits/28164.html · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41187 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-7133 · Nota de Segurança