PT-2009-1769 · Camera Life · Camera Life

Published 2009-02-26 · Updated 2017-08-17 · CVE-2008-6295

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Camera Life version 2.6.2b8

Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various means, including the q parameter to "search.php" and "rss.php", the query string after the image name in "photos/photo", the path parameter to "folder.php", the page parameter and REQUEST URI to "login.php", the ver parameter to "media.php", the theme parameter to "modules/iconset/iconset-debug.php", and the REQUEST URI to "index.php".

Recommendations: For Camera Life version 2.6.2b8, consider disabling the affected parameters, such as q, path, page, ver, theme, and REQUEST URI, in their respective API endpoints until a patch is available. Restrict access to the vulnerable scripts, including "search.php", "rss.php", "folder.php", "login.php", "media.php", "modules/iconset/iconset-debug.php", and "index.php", to minimize the risk of exploitation. Avoid using the vulnerable parameters in the affected API endpoints until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-6295

Affected Products

Camera Life

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-6295 · Security Note
• http://secunia.com/advisories/31234 · Vendor Advisory
• http://digitrustgroup.com/advisories/web-application-security-camera-life2.html · Note
• http://securityfocus.com/bid/32019 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6295 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46285 · Note