PT-2009-5469 · X10 · X10 Mp3 Search Engine
Kingcope
·
Publicado
2009-09-10
·
Atualizado
2017-08-17
·
CVE-2009-3153
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
x10 MP3 Search engine version 1.6.5
Description:
The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via several parameters, including the
pic id parameter to "includes/video ad.php", the category parameter to "linkvideos listing.php", the id parameter to "templates/header1.php" and "mp3/lyrics.php", the key parameter to "video listing.php" and "adult/video listing.php", and the name parameter to "mp3/embed.php" and "mp3/info.php".Recommendations:
For x10 MP3 Search engine version 1.6.5, consider disabling the affected parameters, such as
pic id, category, id, key, and name, in their respective scripts until a patch is available. Restrict access to the vulnerable scripts, including "includes/video ad.php", "linkvideos listing.php", "templates/header1.php", "mp3/lyrics.php", "video listing.php", "adult/video listing.php", "mp3/embed.php", and "mp3/info.php", to minimize the risk of exploitation.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
X10 Mp3 Search Engine