PT-2012-2154 · Esyndicat · Esyndicat Pro

Publicado 2012-09-20 · Atualizado 2017-08-29 · CVE-2011-5177

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions eSyndiCat Pro version 2.3.05

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters, including the id parameter to various admin pages, such as admins, blocks, articles, or suggest-category, and the sort parameter to the search page.

Recommendations For eSyndiCat Pro version 2.3.05, consider restricting access to the admin/controller.php file until a patch is available, and avoid using the id parameter in the admins, blocks, articles, or suggest-category pages, as well as the sort parameter in the search page.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-5177

Produtos afetados

Esyndicat Pro

Referências · 5

• 🔥 http://packetstormsecurity.org/files/view/107324/esyndicatpro-xss.txt · Exploit
• 🔥 https://exploit-db.com/exploits/36362 · Exploit
• 🔥 http://securityfocus.com/bid/50822 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71485 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-5177 · Nota de Segurança