PT-2009-5541 · Almondsoft · Almond Classifieds+1

Publicado 2009-09-16 · Atualizado 2009-09-17 · CVE-2009-3225

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AlmondSoft Almond Classifieds Wap and Pro versions (affected versions not specified) Almond Affiliate Network Classifieds versions (affected versions not specified)

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the page parameter in a browse action to "index.php" or the addr parameter to "gmap.php".

Recommendations For AlmondSoft Almond Classifieds Wap and Pro, as a temporary workaround, consider restricting access to the "index.php" and "gmap.php" files until a patch is available. For Almond Affiliate Network Classifieds, avoid using the page and addr parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-3225

Produtos afetados

Almond Affiliate Network Classifieds

Almond Classifieds

Referências · 6

• 🔥 http://securityfocus.com/bid/35816 · Exploit
• 🔥 http://packetstormsecurity.org/0907-exploits/almondclassifieds-xss.txt · Exploit
• 🔥 https://exploit-db.com/exploits/33117 · Exploit
• 🔥 https://exploit-db.com/exploits/33116 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3225 · Nota de Segurança
• http://secunia.com/advisories/36003 · Aviso do Fabricante