PT-2008-4427 · Phpeasydata · Phpeasydata

Sylvain Thual · Published 2008-07-03 · Updated 2018-10-11 · CVE-2008-2994

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHPEasyData version 1.5.4

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via the annuaire parameter to "last records.php" and "annuaire.php", as well as the by and cat id parameters to "annuaire.php".

Recommendations For PHPEasyData version 1.5.4, consider validating and sanitizing user input for the annuaire, by, and cat id parameters in the affected scripts to prevent arbitrary script or HTML injection. As a temporary workaround, restrict access to the "last records.php" and "annuaire.php" scripts until a proper fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-2994

Affected Products

Phpeasydata

References · 7

• 🔥 https://exploit-db.com/exploits/31907 · Exploit
• 🔥 http://securityfocus.com/bid/29659 · Exploit
• 🔥 https://exploit-db.com/exploits/31906 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-2994 · Security Note
• http://securityfocus.com/archive/1/493273/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42997 · Note
• http://securityreason.com/securityalert/3969 · Note