PT-2019-13104 · Sahi · Sahi Pro

Publicado 2019-10-29 · Atualizado 2019-11-06 · CVE-2019-13066

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sahi Pro version 8.0.0

Description The issue concerns a reflected XSS vulnerability in the script manager arena, located at s /dyn/pro/DBReports. This vulnerability can be triggered by updating specific fields, including Script Name, Suite Name, Base URL, Android, iOS, Scripts Run, Origin Machine, or Comment. The sql parameter can also be used to trigger this issue.

Recommendations For Sahi Pro version 8.0.0, consider restricting access to the s /dyn/pro/DBReports area and avoid using the sql parameter in the affected endpoint until a fix is available. As a temporary workaround, restrict updates to the Script Name, Suite Name, Base URL, Android, iOS, Scripts Run, Origin Machine, or Comment fields to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-13066

Produtos afetados

Sahi Pro

Referências · 4

• 🔥 https://packetstormsecurity.com/files/154985/Sahi-Pro-8.x-Cross-Site-Scripting.html · Exploit
• https://sahipro.com/downloads-archive · Nota
• https://osv.dev/vulnerability/CVE-2019-13066 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13066 · Nota de Segurança