PT-2009-3914 · Webspell · Webspell

Yenh4Cker · Publicado 2009-04-24 · Atualizado 2018-10-10 · CVE-2009-1408

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions webSPELL version 4.2.0c

Description The issue allows remote attackers to inject arbitrary web script or HTML via Javascript events, such as onmouseover, in nested BBcode tags. This can be demonstrated using tags like email, img, and url.

Recommendations For webSPELL version 4.2.0c, consider disabling the use of nested BBcode tags or restricting Javascript events like onmouseover to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-1408

Produtos afetados

Webspell

Referências · 10

• 🔥 http://securityfocus.com/bid/34595 · Exploit
• 🔥 https://exploit-db.com/exploits/8453 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1408 · Nota
• http://secunia.com/advisories/34764 · Aviso do Fabricante
• http://securityfocus.com/archive/1/502732/100/0/threaded · Nota
• http://osvdb.org/53782 · Nota
• http://webspell.org/index.php?site=news_comments&newsID=126&lang=uk · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1408 · Nota de Segurança
• http://webspell.org/index.php?site=files&file=25 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49937 · Nota