PT-2009-1799 · Softbiz · Softbiz Classifieds Script
Published
2009-02-27
·
Updated
2017-08-17
·
CVE-2008-6325
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
Softbiz Classifieds Script (affected versions not specified)
Description:
The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via several parameters, including the
radio parameter to "showcategory.php", "gallery.php", and the msg parameter to various files such as "advertisers/signinform.php", "lostpassword.php", "admin/adminhome.php", and "admin/index.php".Recommendations:
For the "showcategory.php" file, consider restricting access to the
radio parameter until a fix is available.
For the "advertisers/signinform.php" file, avoid using the msg parameter in the affected endpoint until the issue is resolved.
For the "gallery.php" file, restrict access to the radio parameter as a temporary workaround.
For the "lostpassword.php" file, avoid using the msg parameter until a patch is available.
For the "admin/adminhome.php" and "admin/index.php" files, restrict access to the msg parameter to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Softbiz Classifieds Script