PT-2004-3455 · Sambar · Sambar Server

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2564

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sambar Server version 6.1 Beta 2

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via the show parameter in "show.asp" and the title parameter in "showperf.asp".

Recommendations For Sambar Server version 6.1 Beta 2, consider restricting access to the "show.asp" and "showperf.asp" pages until a fix is available, and avoid using the show and title parameters in these pages to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-2564

Affected Products

Sambar Server

References · 11

• 🔥 https://exploit-db.com/exploits/24162 · Exploit
• 🔥 http://secunia.com/advisories/11748 · Exploit
• 🔥 http://securitytracker.com/id?1010353 · Exploit
• 🔥 http://securityfocus.com/bid/10444 · Exploit
• 🔥 http://osvdb.org/6584 · Exploit
• 🔥 http://osvdb.org/6583 · Exploit
• 🔥 http://oliverkarow.de/research/sambar.txt · Exploit
• 🔥 https://exploit-db.com/exploits/24161 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2564 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16286 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2564 · Note