PT-2009-2145 · Quickersite · Quickersite

Published 2009-04-08 · Updated 2017-08-17 · CVE-2008-6675

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions QuickerSite version 1.8.5

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various parameters and headers in different files, including the "close" parameter to "showThumb.aspx", "SB redirect" and "SB feedback" parameters in "process send.asp", "paramCode" and "cColor" parameters to "picker.asp", and the query string, Referer header, and X-FORWARDED-FOR header to "rss.asp".

Recommendations For QuickerSite version 1.8.5, consider disabling or restricting access to the vulnerable parameters and files, such as the "close" parameter in "showThumb.aspx", "SB redirect" and "SB feedback" parameters in "process send.asp", "paramCode" and "cColor" parameters in "picker.asp", and the query string, Referer header, and X-FORWARDED-FOR header in "rss.asp", until a patch is available. Avoid using these parameters and headers in the affected files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-6675

Affected Products

Quickersite

References · 9

• 🔥 https://exploit-db.com/exploits/5733 · Exploit
• 🔥 http://bugreport.ir/39/exploit.htm · Exploit
• 🔥 http://bugreport.ir/index_39.htm · Exploit
• http://secunia.com/advisories/30501 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6675 · Security Note
• http://osvdb.org/46221 · Note
• http://securityfocus.com/bid/29524 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6675 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42860 · Note