PT-2013-1974 · Netart Media · Netart Media Car Portal

The_Storm · Publicado 2013-01-24 · Atualizado 2013-01-29 · CVE-2012-6510

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NetArt Media Car Portal version 3.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via several fields, including the PWRS field, Description field when posting a new vehicle, news title when creating news, Name when creating a sub user, group name when creating a group, or dealer name, first name, or last name when changing a profile.

Recommendations For NetArt Media Car Portal version 3.0, update the software to a version that includes fixes for the cross-site scripting vulnerabilities. As a temporary workaround, consider restricting user input for the PWRS, Description, news title, Name, group name, dealer name, first name, and last name fields to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-6510

Produtos afetados

Netart Media Car Portal

Referências · 6

• 🔥 https://exploit-db.com/exploits/18801 · Exploit
• 🔥 http://packetstormsecurity.org/files/112226/Car-Portal-CMS-3.0-CSRF-XSS-Shell-Upload.html · Exploit
• http://securityfocus.com/bid/53267 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6510 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6510 · Nota
• http://vulnerability-lab.com/get_content.php?id=502 · Nota