PT-2009-4276 · Mygesuad · Mygesuad

Yenh4Cker · Publicado 2009-05-29 · Atualizado 2017-09-29 · CVE-2009-1811

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: myGesuad version 0.9.14

Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various parameters in different modules, including the Page parameter in a List action to "modules/ereignis.php", the Kontext parameter in a Search action to "modules/kategorie.php", the image parameter to "modules/image.php", or the ID parameter in a Detail action to "modules/sitzung.php".

Recommendations: For myGesuad version 0.9.14, consider disabling the affected modules (ereignis.php, kategorie.php, image.php, sitzung.php) until a patch is available. Restrict access to these modules to minimize the risk of exploitation. Avoid using the parameters Page, Kontext, image, and ID in the respective API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-1811

Produtos afetados

Mygesuad

Referências · 5

• 🔥 http://securityfocus.com/bid/34998 · Exploit
• 🔥 https://exploit-db.com/exploits/8708 · Exploit
• http://secunia.com/advisories/35136 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1811 · Nota de Segurança
• http://vupen.com/english/advisories/2009/1345 · Nota