PT-2018-16984 · Foxsash · Foxsash Imghosting

Dennis Veninga · Publicado 2018-01-15 · Atualizado 2018-02-05 · CVE-2018-5479

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FoxSash ImgHosting version 1.5

Description The issue allows for XSS attacks, specifically through the search engine function via the search parameter to the default URI. This could enable attackers to steal user and admin sessions by sending infected URLs, which would execute malicious code.

Recommendations For FoxSash ImgHosting version 1.5, as a temporary workaround, consider disabling the search function until a patch is available. Restrict access to the user/admin login interface to minimize the risk of session theft. Avoid using the search parameter in the affected URI until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-5479

Produtos afetados

Foxsash Imghosting

Referências · 3

• 🔥 https://exploit-db.com/exploits/43567 · Exploit
• https://osv.dev/vulnerability/CVE-2018-5479 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-5479 · Nota de Segurança