PT-2008-5032 · Xoops · Yogurt Social Network

Published 2008-08-13 · Updated 2017-08-08 · CVE-2008-3668

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Yogurt Social Network module version 3.2 rc1 for XOOPS

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via the uid parameter to various API endpoints, including "friends.php", "seutubo.php", "album.php", "scrapbook.php", "index.php", or "tribes.php", or through the description field of a new scrap.

Recommendations For Yogurt Social Network module version 3.2 rc1, consider disabling the affected API endpoints ("friends.php", "seutubo.php", "album.php", "scrapbook.php", "index.php", "tribes.php") and restricting access to the description field of new scraps until a patch is available. Avoid using the uid parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-3668

Affected Products

Yogurt Social Network

References · 12

• 🔥 https://exploit-db.com/exploits/32203 · Exploit
• 🔥 https://exploit-db.com/exploits/32201 · Exploit
• 🔥 https://exploit-db.com/exploits/32200 · Exploit
• 🔥 https://exploit-db.com/exploits/32199 · Exploit
• 🔥 https://exploit-db.com/exploits/32202 · Exploit
• 🔥 https://exploit-db.com/exploits/32198 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3668 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44387 · Note
• http://securityfocus.com/bid/30618 · Note
• http://lostmon.blogspot.com/2008/08/yogurt-social-network-multiple-scripts.html · Note
• http://securityfocus.com/bid/30619 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44385 · Note