PT-2018-17100 · Reservo · Reservo Image Hosting

Dennis Veninga · Publicado 2018-01-24 · Atualizado 2018-02-09 · CVE-2018-5705

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Reservo Image Hosting version 1.6

Description: The issue allows for XSS attacks, potentially enabling attackers to steal user sessions, including those of administrators, by executing malicious code when an infected URL is accessed. This is particularly concerning due to the presence of a user/admin login interface. The vulnerability is specifically related to the search engine function, which is accessible through the "t" parameter to the "/search" URI.

Recommendations: For Reservo Image Hosting version 1.6, consider disabling the search engine function or restricting access to the /search URI until a fix is available. Additionally, avoid using the t parameter in the /search URI to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-5705

Produtos afetados

Reservo Image Hosting

Referências · 4

• 🔥 https://exploit-db.com/exploits/43676 · Exploit
• 🔥 http://packetstormsecurity.com/files/145940/Reservo-Image-Hosting-Script-1.5-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-5705 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-5705 · Aviso do Fabricante