PT-2017-15145 · Biometric Shift · Biometric Shift Employee Management System

52Pojie · Publicado 2017-12-30 · Atualizado 2018-01-09 · CVE-2017-17989

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System (affected versions not specified)

Description The issue is related to a security problem where an attacker can inject malicious code. This is possible due to the lack of proper input validation in the holiday name parameter when performing an edit holiday action in the index.php file.

Recommendations As a temporary workaround, consider restricting access to the index.php file or the edit holiday action until a patch is available. Avoid using the holiday name parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-17989

Produtos afetados

Biometric Shift Employee Management System

Referências · 3

• 🔥 https://github.com/d4wner/Vulnerabilities-Report/blob/master/Biometric-Shift-Employee-Management-System.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-17989 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-17989 · Aviso do Fabricante