PT-2005-4933 · Snipe · Snipe Gallery

Qex · Published 2005-12-14 · Updated 2011-03-08 · CVE-2005-4245

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Snipe Gallery versions 3.1.4 and earlier

Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the keyword parameter in the "search.php" endpoint.

Recommendations For Snipe Gallery versions 3.1.4 and earlier, update to a version later than 3.1.4 to resolve the issue. As a temporary workaround, consider restricting access to the search.php endpoint or sanitizing the keyword parameter to prevent malicious input.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2005-4245

Affected Products

Snipe Gallery

References · 8

• 🔥 http://pridels0.blogspot.com/2005/12/snipe-gallery-sqlxss-vuln.html · Exploit
• 🔥 http://securityfocus.com/bid/15844 · Exploit
• 🔥 http://securityreason.com/securityalert/716 · Exploit
• 🔥 https://exploit-db.com/exploits/26801 · Exploit
• http://secunia.com/advisories/18022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4245 · Security Note
• http://osvdb.org/21695 · Note
• http://vupen.com/english/advisories/2005/2882 · Note