PT-2012-5666 · Simple Invoices · Simple Invoices

Publicado 2012-12-28 · Atualizado 2013-10-11 · CVE-2012-4932

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SimpleInvoices versions prior to stable-2012-1-CIS3000

Description The issue allows remote attackers to inject arbitrary web script or HTML via various fields and parameters, including the having parameter in a manage action to "index.php", the Email field in an Add User action, and multiple fields in Add Customer, Add Biller, Add Invoice, Process Payment, Payment Types, Invoice Preferences, Manage Products, and Tax Rates actions.

Recommendations For SimpleInvoices versions prior to stable-2012-1-CIS3000, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the affected fields and parameters, such as the having parameter, Email field, Customer Name field, and others, until a patch is available. Avoid using these fields in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-4932

Produtos afetados

Simple Invoices

Referências · 3

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-12/0074.html · Exploit
• 🔥 https://exploit-db.com/exploits/38115 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-4932 · Nota de Segurança