PT-2005-4936 · Quickpaypro · Quickpaypro

Published 2005-12-15 · Updated 2011-03-08 · CVE-2005-4248

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions QuickPayPro version 3.1

Description The issue allows remote attackers to inject arbitrary web script or HTML via various fields. Specifically, the affected API endpoints include "communication/subscribers.tracking.add.php", "support/tickets.add.php", and "mycompany/categories.php".

Recommendations For QuickPayPro version 3.1, consider disabling access to the affected endpoints "communication/subscribers.tracking.add.php", "support/tickets.add.php", and "mycompany/categories.php" until a patch is available. Restrict input validation for fields in these endpoints to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-4248

Affected Products

Quickpaypro

References · 8

• http://secunia.com/advisories/17981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4248 · Security Note
• http://pridels0.blogspot.com/2005/12/quickpaypro-31-multiple-vuln.html · Note
• http://osvdb.org/21683 · Note
• http://securityfocus.com/bid/15863 · Note
• http://osvdb.org/21684 · Note
• http://vupen.com/english/advisories/2005/2875 · Note
• http://osvdb.org/21682 · Note