PT-2010-1488 · Winn · Winn Guestbook

Indoushka · Publicado 2010-03-08 · Atualizado 2017-08-17 · CVE-2009-4678

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Winn Guestbook version 2.4

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the PATH INFO in index.php.

Recommendations For Winn Guestbook version 2.4, update to a version where this issue is fixed, or as a temporary workaround, consider restricting access to the index.php file to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-4678

Produtos afetados

Winn Guestbook

Referências · 7

• 🔥 http://exploit-db.com/exploits/10653 · Exploit
• 🔥 https://exploit-db.com/exploits/10653 · Exploit
• 🔥 http://packetstormsecurity.org/0912-exploits/winngb-xss.txt · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55086 · Nota
• http://secunia.com/advisories/37963 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-4678 · Nota de Segurança
• http://osvdb.org/61350 · Nota