PT-2011-5130 · Joomla · Barter Sites

Chris Russell · Publicado 2011-12-15 · Atualizado 2011-12-15 · CVE-2011-4830

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Barter Sites component version 1.3 for Joomla!

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via several parameters, including listing title, description, homeurl, paystring, sell price, shipping cost, and quantity, in the com listing component. This is achieved by sending malicious input to the "index.php" endpoint.

Recommendations For Barter Sites component version 1.3, avoid using the vulnerable parameters listing title, description, homeurl, paystring, sell price, shipping cost, and quantity in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-4830

Produtos afetados

Barter Sites

Referências · 5

• 🔥 http://exploit-db.com/exploits/18046 · Exploit
• 🔥 https://exploit-db.com/exploits/18046 · Exploit
• http://docs.joomla.org/Vulnerable_Extensions_List#Barter_Sites_1.3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4830 · Nota de Segurança
• http://my.barter-sites.com/index.php?option=com_content&view=article&id=6&Itemid=25 · Nota