PT-2014-8898 · Websitebaker · Websitebaker

Manuel Garcia Cardenas · Publicado 2014-12-03 · Atualizado 2014-12-05 · CVE-2014-9243

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebsiteBaker version 2.8.3

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the QUERY STRING to "wb/admin/admintools/tool.php" or the section id parameter to several files in the wb/modules/ directory, including "edit module files.php", "news/add post.php", "news/modify group.php", "news/modify post.php", and "news/modify settings.php".

Recommendations For WebsiteBaker version 2.8.3, consider disabling access to the vulnerable API endpoints and parameters, such as the QUERY STRING to "wb/admin/admintools/tool.php" and the section id parameter in the affected files, until a patch is available. Restrict access to the vulnerable modules in the wb/modules/ directory to minimize the risk of exploitation. Avoid using the section id parameter in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-9243

Produtos afetados

Websitebaker

Referências · 5

• 🔥 http://packetstormsecurity.com/files/129140/WebsiteBaker-2.8.3-XSS-SQL-Injection-HTTP-Response-Splitting.html · Exploit
• 🔥 https://exploit-db.com/exploits/35277 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Nov/44 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9243 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9243 · Nota