PT-2013-2010 · Vanilla Forums · Firstlastnames Plugin

Henry Hoggard · Publicado 2013-05-23 · Atualizado 2020-06-04 · CVE-2012-6556

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FirstLastNames plugin version 1.1.1 for Vanilla Forums

Description The issue allows remote attackers to inject arbitrary web script or HTML via the User/FirstName or User/LastName parameter to the edit user page, potentially leading to cross-site scripting (XSS) attacks.

Recommendations For FirstLastNames plugin version 1.1.1, consider restricting access to the edit user page or validating and sanitizing the User/FirstName and User/LastName parameters to prevent arbitrary web script or HTML injection until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-6556

Produtos afetados

Firstlastnames Plugin

Referências · 6

• 🔥 https://exploit-db.com/exploits/18912 · Exploit
• 🔥 http://exploit-db.com/exploits/18912 · Exploit
• http://henryhoggard.co.uk/security/197 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6556 · Nota de Segurança
• http://securityfocus.com/bid/53637 · Nota
• http://secunia.com/advisories/49215 · Aviso do Fabricante