PT-2011-1503 · Seo Panel · Seo Panel

Mark Stanislav · Publicado 2011-01-20 · Atualizado 2018-10-10 · CVE-2010-4331

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Seo Panel version 2.2.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via the default news or sponsors cookies. These cookies are not properly handled by controllers such as controllers/index.ctrl.php or controllers/settings.ctrl.php.

Recommendations For Seo Panel version 2.2.0, consider disabling the handling of default news and sponsors cookies in the affected controllers until a patch is available. Restrict access to controllers/index.ctrl.php and controllers/settings.ctrl.php to minimize the risk of exploitation. Avoid using the default news and sponsors cookies in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-4331

Produtos afetados

Seo Panel

Referências · 8

• 🔥 http://uncompiled.com/2011/01/seo-panel-cookie-rendered-persistent-xss-vulnerability-cve-2010-4331 · Exploit
• 🔥 http://exploit-db.com/exploits/16000 · Exploit
• 🔥 https://exploit-db.com/exploits/16000 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4331 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64725 · Nota
• http://securityfocus.com/bid/45828 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4331 · Nota de Segurança
• http://securityfocus.com/archive/1/515768/100/0/threaded · Nota