PT-2009-6599 · Xstate · Xstate Real Estate

Moudi · Publicado 2009-12-30 · Atualizado 2017-09-19 · CVE-2009-4478

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Xstate Real Estate version 1.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to specific endpoints, such as "home.html" or "lands.html". This can lead to cross-site scripting (XSS) attacks.

Recommendations For Xstate Real Estate version 1.0, update the software to prevent remote attackers from injecting arbitrary web script or HTML. As a temporary workaround, consider restricting access to the "home.html" and "lands.html" endpoints until a patch is available. Avoid using the PATH INFO to inject user-controlled input in these endpoints.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-4478

Produtos afetados

Xstate Real Estate

Referências · 7

• 🔥 http://osvdb.org/57671 · Exploit
• 🔥 http://osvdb.org/57672 · Exploit
• 🔥 https://exploit-db.com/exploits/9565 · Exploit
• 🔥 http://exploit-db.com/exploits/9565 · Exploit
• http://secunia.com/advisories/36529 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52970 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4478 · Nota de Segurança