PT-2007-4607 · Stphp · Stphp Easynews Pro

Published 2007-06-21 · Updated 2017-07-29 · CVE-2007-3330

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions STphp EasyNews PRO version 4.0

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a news post. The news post is stored in the news/ directory without proper sanitization, enabling the execution of malicious scripts.

Recommendations For STphp EasyNews PRO version 4.0, ensure that all user input, especially news posts, is properly sanitized before being stored or displayed to prevent the injection of malicious scripts. As a temporary workaround, consider disabling the news posting feature until a proper fix is implemented to sanitize user input.

Fix

Related Identifiers

CVE-2007-3330

Affected Products

Stphp Easynews Pro

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-3330 · Security Note
• http://osvdb.org/36472 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34892 · Note
• http://securityreason.com/securityalert/2829 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/064051.html · Note
• http://securityfocus.com/bid/24512 · Note