PT-2015-3501 · Cosmoshop · Cosmoshop Epro

Publicado 2015-01-01 · Atualizado 2015-01-02 · CVE-2011-5305

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CosmoShop ePRO version 10.05.00

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via the rcopy parameter to "cgi-bin/admin/rubrikadmin.cgi", the typ parameter to "cgi-bin/admin/artikeladmin.cgi", or the suchbegriff parameter to "cgi-bin/admin/shophilfe suche.cgi".

Recommendations For CosmoShop ePRO version 10.05.00, consider disabling access to the vulnerable CGI scripts until a patch is available. Restrict input for the rcopy, typ, and suchbegriff parameters in their respective CGI scripts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-5305

Produtos afetados

Cosmoshop Epro

Referências · 2

• 🔥 https://htbridge.com/advisory/HTB22878 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5305 · Nota de Segurança