PT-2018-14991 · Jtbc · Jtbc

Publicado 2018-11-26 · Atualizado 2020-08-24 · CVE-2018-19546

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JTBC(PHP) version 3.0.1.7

Description The issue concerns a CSRF vulnerability that can be exploited via the "console/xml/manage.php?type=action&action=edit" URI. It is demonstrated by an XSS payload in the content parameter.

Recommendations For JTBC(PHP) version 3.0.1.7, consider restricting access to the "console/xml/manage.php" endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the content parameter in the affected URI until the issue is resolved.

Exploit

Correção

CSRF

XSS

Enumeração de Fraquezas

CWE-352

CWE-79

Identificadores relacionados

CVE-2018-19546

Produtos afetados

Jtbc

Referências · 4

• 🔥❌ https://github.com/toiron/setest/blob/master/csrfandxss.html · Exploit, Deleted
• 🔥❌ https://github.com/toiron/setest · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2018-19546 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-19546 · Nota de Segurança