PT-2005-2751 · Unknown · Bookreview

Lostmon · Published 2005-05-31 · Updated 2008-09-10 · CVE-2005-1783

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BookReview version 1.0

Description The issue allows remote attackers to obtain the path of the web server via certain parameters to "search.htm". This is possibly due to a search[string] parameter with a missing value or an incorrect submit[type] value, which reveals the path in the resulting error message.

Recommendations For BookReview version 1.0, as a temporary workaround, consider restricting access to the "search.htm" endpoint until a patch is available. Avoid using the search[string] parameter and submit[type] value in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2005-1783

Affected Products

Bookreview

References · 5

• 🔥 http://lostmon.blogspot.com/2005/05/bookreview-10-multiple-variable-xss.html · Exploit
• 🔥 http://osvdb.org/16881 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1783 · Security Note
• http://secunia.com/advisories/1014058 · Note
• http://osvdb.org/16880 · Note