PT-2003-2230 · Sambar · Sambar Server

Published 2003-12-31 · Updated 2017-07-11 · CVE-2003-1285

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sambar Server versions prior to 6.0 beta 6

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. This can be achieved via the query string to various API endpoints and scripts, including (1) isapi/testisa.dll, (2) testcgi.exe, (3) environ.pl, (4) the query parameter to samples/search.dll, (5) the price parameter to mortgage.pl, (6) the query string in dumpenv.pl, (7) the query string to dumpenv.pl, and (8) the E-Mail field of the guestbook script (book.pl).

Recommendations For Sambar Server versions prior to 6.0 beta 6, update to version 6.0 beta 6 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2003-1285

Affected Products

Sambar Server

References · 13

• 🔥 http://osvdb.org/5784 · Exploit
• 🔥 http://osvdb.org/5782 · Exploit
• 🔥 http://osvdb.org/5783 · Exploit
• 🔥 http://osvdb.org/5805 · Exploit
• 🔥 http://osvdb.org/5785 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1285 · Security Note
• http://idefense.com/application/poi/display?id=103&type=vulnerabilities&flashstatus=true · Vendor Advisory
• http://sambar.com/security.htm · Vendor Advisory
• http://securitytracker.com/id?1007819 · Patch
• http://secunia.com/advisories/9578 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13305 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1285 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16056 · Note