PT-2015-4263 · Papoo · Cms Papoo Light

Publicado 2015-01-05 · Atualizado 2018-10-09 · CVE-2014-9522

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CMS Papoo Light version 6.0.0 (Rev 4701)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the author field to "guestbook.php" and the username field to "account.php" are vulnerable.

Recommendations For CMS Papoo Light version 6.0.0 (Rev 4701), consider disabling the guestbook.php and account.php scripts until a patch is available to prevent exploitation through the author and username fields. Restrict access to these scripts to minimize the risk of XSS attacks. Avoid using the author field in "guestbook.php" and the username field in "account.php" until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-9522

Produtos afetados

Cms Papoo Light

Referências · 8

• 🔥 http://exploit-db.com/exploits/35551 · Exploit
• 🔥 https://exploit-db.com/exploits/35551 · Exploit
• 🔥 http://sroesemann.blogspot.de/2014/12/bericht-zu-advisory-sroeadv-2014-01.html · Exploit
• 🔥 http://packetstormsecurity.com/files/129586/CMS-Papoo-6.0.0-Revision-4701-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9522 · Nota de Segurança
• http://osvdb.org/show/osvdb/115944 · Nota
• http://securityfocus.com/archive/1/534243/100/0/threaded · Nota
• http://securityfocus.com/bid/71676 · Nota