PT-2010-1729 · Econtact Pro · Online Contact Manager

Publicado 2010-07-09 · Atualizado 2010-07-12 · CVE-2009-4926

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Online Contact Manager (formerly EContact PRO) version 3.0

Description The issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the showGroup parameter to "/index.php" and the id parameter to "/view.php", "/email.php", "/edit.php", and "/delete.php".

Recommendations For Online Contact Manager (formerly EContact PRO) version 3.0, consider validating and sanitizing user input for the showGroup and id parameters to prevent arbitrary web script or HTML injection. As a temporary workaround, restrict access to the affected API endpoints until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-4926

Produtos afetados

Online Contact Manager

Referências · 9

• 🔥 https://exploit-db.com/exploits/32936 · Exploit
• 🔥 http://securityfocus.com/bid/34626 · Exploit
• 🔥 http://packetstorm.linuxsecurity.com/0904-exploits/ocm30-xss.txt · Exploit
• 🔥 https://exploit-db.com/exploits/32934 · Exploit
• 🔥 https://exploit-db.com/exploits/32935 · Exploit
• 🔥 https://exploit-db.com/exploits/32933 · Exploit
• 🔥 https://exploit-db.com/exploits/32937 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4926 · Nota de Segurança
• http://secunia.com/advisories/34826 · Aviso do Fabricante