PT-2010-4349 · Unknown · Event Horizon

Publicado 2010-07-23 · Atualizado 2010-07-26 · CVE-2010-2854

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Event Horizon (EVH) version 1.1.10

Description The issue allows remote attackers to inject arbitrary web script or HTML via the YourEmail and VerificationNumber parameters in modfile.php, which are not properly handled in a forced SQL error message when magic quotes gpc is disabled.

Recommendations For Event Horizon (EVH) version 1.1.10, consider disabling the YourEmail and VerificationNumber parameters in modfile.php until a patch is available, or ensure that magic quotes gpc is enabled to prevent exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-2854

Produtos afetados

Event Horizon

Referências · 3

• http://freshmeat.net/projects/eventh · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2854 · Nota de Segurança
• http://secunia.com/advisories/40517 · Aviso do Fabricante