PT-2011-2403 · Vam · Vam Shop

Publicado 2011-01-20 · Atualizado 2018-10-09 · CVE-2011-0504

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions VaM Shop versions 1.6 through 1.6.1 VaM Shop versions prior to 1.6

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the status parameter to "admin/orders.php", the search parameter to "admin/customers.php", or the STORE NAME parameter to "admin/configuration.php".

Recommendations For VaM Shop versions 1.6 through 1.6.1, avoid using the status parameter in "admin/orders.php", the search parameter in "admin/customers.php", and the STORE NAME parameter in "admin/configuration.php" until a fix is available. For VaM Shop versions prior to 1.6, consider the same mitigation measures as above, focusing on restricting access to the mentioned parameters in the respective PHP files. As a temporary workaround, consider disabling access to "admin/orders.php", "admin/customers.php", and "admin/configuration.php" until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-0504

Produtos afetados

Vam Shop

Referências · 12

• 🔥 http://securityfocus.com/archive/1/515615/100/0/threaded · Exploit
• 🔥 http://securityfocus.com/archive/1/515619/100/0/threaded · Exploit
• 🔥 https://exploit-db.com/exploits/15968 · Exploit
• 🔥 http://osvdb.org/70429 · Exploit
• 🔥 http://htbridge.ch/advisory/xss_vulnerability_in_vam_shop.html · Exploit
• 🔥 http://htbridge.ch/advisory/xss_vulnerability_in_vam_shop_1.html · Exploit
• 🔥 http://htbridge.ch/advisory/xss_vulnerability_in_vam_shop_2.html · Exploit
• 🔥 http://exploit-db.com/exploits/15968 · Exploit
• http://osvdb.org/70430 · Nota
• http://secunia.com/advisories/42869 · Aviso do Fabricante
• http://securityfocus.com/archive/1/515620/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0504 · Nota de Segurança