PT-2009-5667 · Datemill · Datemill

Publicado 2009-09-24 · Atualizado 2017-08-17 · CVE-2009-3360

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Datemill version 1.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities are found in the "return" parameter to "photo view.php", and the "st" parameter to both "photo search.php" and "search.php".

Recommendations For Datemill version 1.0, as a temporary workaround, consider restricting access to the photo view.php, photo search.php, and search.php scripts until a patch is available. Avoid using the return parameter in photo view.php and the st parameter in photo search.php and search.php to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-3360

Produtos afetados

Datemill

Referências · 10

• 🔥 https://exploit-db.com/exploits/34548 · Exploit
• 🔥 https://exploit-db.com/exploits/34550 · Exploit
• 🔥 https://exploit-db.com/exploits/34549 · Exploit
• 🔥 http://packetstormsecurity.org/0909-exploits/datemill-xss.txt · Exploit
• http://secunia.com/advisories/36608 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53177 · Nota
• http://osvdb.org/57990 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3360 · Nota de Segurança
• http://osvdb.org/57991 · Nota
• http://osvdb.org/57989 · Nota