PT-2018-14992 · Jtbc · Jtbc

Publicado 2018-11-26 · Atualizado 2018-12-19 · CVE-2018-19547

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions JTBC(PHP) version 3.0.1.7

Description The issue is related to a cross-site scripting (XSS) problem. It occurs via the "console/xml/manage.php" API endpoint, specifically when the type parameter is set to "action" and the action parameter is set to "edit". The content parameter is vulnerable, allowing for potential XSS attacks.

Recommendations For JTBC(PHP) version 3.0.1.7, as a temporary workaround, consider restricting access to the "console/xml/manage.php" API endpoint, specifically when the type parameter is set to "action" and the action parameter is set to "edit", to minimize the risk of exploitation. Avoid using the content parameter in this endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-19547

Produtos afetados

Jtbc

Referências · 4

• 🔥❌ https://github.com/toiron/setest/blob/master/csrfandxss.html · Exploit, Deleted
• 🔥❌ https://github.com/toiron/setest · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2018-19547 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-19547 · Nota de Segurança