PT-2014-8757 · Phpsound · Phpsound

Publicado 2014-11-17 · Atualizado 2015-08-06 · CVE-2014-8954

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpSound version 1.0.5

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific fields, including the Title or Description fields in a playlist, or the filter parameter in an explore action to "index.php".

Recommendations For phpSound version 1.0.5, consider restricting user input for the Title and Description fields in playlists and the filter parameter in explore actions to prevent arbitrary web script or HTML injection until a patch is available. As a temporary workaround, disabling the ability to input HTML in these fields can help mitigate the risk.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-8954

Produtos afetados

Phpsound

Referências · 5

• 🔥 http://packetstormsecurity.com/files/129104/phpSound-Music-Sharing-Platform-1.0.5-Cross-Site-Scripting.html · Exploit
• 🔥 http://exploit-db.com/exploits/35198 · Exploit
• 🔥 https://exploit-db.com/exploits/35198 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8954 · Nota de Segurança
• http://securityfocus.com/bid/71172 · Nota