PT-2008-3556 · Editeurscripts · Editeurscripts Escontacts

Published 2008-04-30 · Updated 2017-08-08 · CVE-2008-2037

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions EditeurScripts EsContacts version 1.0

Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This is achieved via the msg parameter to several API endpoints, including "login.php", "importer.php", "add groupe.php", "contacts.php", "groupes.php", and "search.php".

Recommendations For EditeurScripts EsContacts version 1.0, consider restricting access to the msg parameter in the affected API endpoints until a patch is available. As a temporary workaround, avoid using the msg parameter in the "login.php", "importer.php", "add groupe.php", "contacts.php", "groupes.php", and "search.php" endpoints to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-2037

Affected Products

Editeurscripts Escontacts

References · 12

• 🔥 https://exploit-db.com/exploits/31661 · Exploit
• 🔥 https://exploit-db.com/exploits/31664 · Exploit
• 🔥 https://exploit-db.com/exploits/31660 · Exploit
• 🔥 https://exploit-db.com/exploits/31662 · Exploit
• 🔥 https://exploit-db.com/exploits/31665 · Exploit
• 🔥 http://securityfocus.com/bid/28825 · Exploit
• 🔥 https://exploit-db.com/exploits/31663 · Exploit
• http://secunia.com/advisories/29877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2037 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41879 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49237 · Note
• http://z0rlu.ownspace.org/index.php?/archives/50-EScontacts-XSS.html · Note