PT-2009-6403 · Cutenews · Cutenews

Publicado 2009-12-10 · Atualizado 2018-10-10 · CVE-2009-4249

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CuteNews version 1.4.6

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can occur through the lastusername and mod parameters to "index.php", and the title parameter to "search.php", when register globals is enabled and magic quotes gpc is disabled.

Recommendations For CuteNews version 1.4.6, consider disabling the register globals setting and enabling magic quotes gpc to mitigate the risk of exploitation. Additionally, restrict access to the index.php and search.php files to minimize the risk of XSS attacks. Avoid using the lastusername, mod, and title parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-4249

Produtos afetados

Cutenews

Referências · 9

• 🔥 http://morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt · Exploit
• 🔥 https://exploit-db.com/exploits/33342 · Exploit
• 🔥 http://securityfocus.com/bid/36971 · Exploit
• 🔥 https://exploit-db.com/exploits/10002 · Exploit
• http://securityfocus.com/archive/1/507782/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54220 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54222 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54219 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4249 · Nota de Segurança