PT-2008-5267 · Opendb · Opendb

Published 2008-09-05 · Updated 2025-04-03 · CVE-2008-3937

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenDb version 1.0.6

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the user id parameter in an edit action to "user admin.php", the title parameter to "listings.php", and the redirect url parameter to "user profile.php".

Recommendations For OpenDb version 1.0.6, avoid using the user id parameter in the edit action to "user admin.php", the title parameter to "listings.php", and the redirect url parameter to "user profile.php" until a fix is available. Consider restricting access to these parameters to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-3937

Affected Products

Opendb

References · 8

• 🔥 https://exploit-db.com/exploits/32314 · Exploit
• 🔥 https://exploit-db.com/exploits/32315 · Exploit
• 🔥 http://packetstorm.linuxsecurity.com/0808-exploits/omcd-xssxsrf.txt · Exploit
• 🔥 https://exploit-db.com/exploits/32313 · Exploit
• http://secunia.com/advisories/31719 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3937 · Security Note
• https://t.me/cvenotify/117594 · Telegram Post
• http://securityfocus.com/bid/30989 · Note