PT-2009-5112 · Achievo · Achievo

Publicado 2009-10-16 · Atualizado 2018-10-10 · CVE-2009-2733

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Achievo versions prior to 1.4.0

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through the scheduler title in the scheduler module or via specific parameters to the Organization Contracts administration page, including atksearch[contractnumber], atksearch AE customer[customer], atksearchmode[contracttype], and possibly atksearch[contractname], which are accessible through the "dispatch.php" endpoint.

Recommendations For versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the scheduler module and the Organization Contracts administration page, and avoid using the vulnerable parameters until the update is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-2733

Produtos afetados

Achievo

Referências · 12

• 🔥 http://securityfocus.com/bid/36661 · Exploit
• 🔥 http://bonsai-sec.com/research/vulnerabilities/achievo-multiple-xss-0101.txt · Exploit
• 🔥 https://exploit-db.com/exploits/9863 · Exploit
• 🔥 https://exploit-db.com/exploits/33281 · Exploit
• http://bonsai-sec.com/blog/index.php/cross-site-scripting-payloads · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53745 · Nota
• http://securityfocus.com/archive/1/507133/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53744 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2733 · Nota de Segurança
• http://secunia.com/advisories/37035 · Aviso do Fabricante
• http://achievo.org/download/releasenotes/1_4_0 · Correção
• http://securitytracker.com/id?1023017 · Nota