PT-2008-3965 · Tr Script · Tr Script News

Published 2008-05-29 · Updated 2017-08-08 · CVE-2008-2508

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Tr Script News version 2.1

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the nb parameter in 'voir' mode. This can occur in the news.php file.

Recommendations For Tr Script News version 2.1, avoid using the nb parameter in 'voir' mode until the issue is resolved. As a temporary workaround, consider restricting access to the news.php file to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-2508

Affected Products

Tr Script News

References · 5

• 🔥 http://securityfocus.com/bid/29388 · Exploit
• 🔥 https://exploit-db.com/exploits/31855 · Exploit
• 🔥 http://z0rlu.ownspace.org/index.php?/archives/91-TR-News-v2.1-xss.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-2508 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42648 · Note