PT-2008-5141 · Acg · Acg-Ptp

Published 2008-08-26 · Updated 2017-08-08 · CVE-2008-3782

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ACG-PTP version 1.0.6

Description The issue allows remote authenticated administrators to inject arbitrary web script or HTML via specific fields, including the Category name field under Advertisement Packages, the Reason field under Credit/Debit Users, and the FAQ question and FAQ answer fields under Add New FAQ Entry.

Recommendations For ACG-PTP version 1.0.6, as a temporary workaround, consider restricting access to the admin/index.php file until a patch is available. Avoid using the Category name, Reason, FAQ question, and FAQ answer fields in the affected areas until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-3782

Affected Products

Acg-Ptp

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2008-3782 · Security Note
• http://secunia.com/advisories/31591 · Vendor Advisory
• http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064038.html · Note
• http://securityfocus.com/bid/30793 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44603 · Note