PT-2009-5674 · Unknown · Image Gallery

Publicado 2009-09-24 · Atualizado 2009-09-25 · CVE-2009-3367

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions An image gallery version 1.0

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via the path parameter to "index.php" and "main.php", and the show parameter to "main.php".

Recommendations For An image gallery version 1.0, consider restricting access to the "index.php" and "main.php" API endpoints until a fix is available. As a temporary workaround, avoid using the path and show parameters in the affected API endpoints.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-3367

Produtos afetados

Image Gallery

Referências · 5

• 🔥 https://exploit-db.com/exploits/9636 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3367 · Nota de Segurança
• http://osvdb.org/57945 · Nota
• http://secunia.com/advisories/36680 · Aviso do Fabricante
• http://osvdb.org/57944 · Nota