PT-2008-3331 · Smart · Smart Photo Ads+2

Published 2008-04-15 · Updated 2017-08-08 · CVE-2008-1793

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Smart Classified ADS Professional (affected versions not specified) Smart Photo ADS (affected versions not specified) Smart Photo ADS Gold (affected versions not specified)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the AdNum and Department parameters in the view.cgi component.

Recommendations For Smart Classified ADS Professional, restrict access to the view.cgi component to minimize the risk of exploitation. For Smart Photo ADS, avoid using the AdNum and Department parameters in the view.cgi component until the issue is resolved. For Smart Photo ADS Gold, consider disabling the view.cgi component as a temporary workaround until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-1793

Affected Products

Smart Classified Ads Professional

Smart Photo Ads

Smart Photo Ads Gold

References · 4

• http://secunia.com/advisories/29623 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1793 · Security Note
• http://securityfocus.com/bid/28595 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41611 · Note