PT-2009-2512 · Unknown · Fresh Email Script

Don · Published 2009-08-24 · Updated 2017-09-29 · CVE-2008-7043

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Fresh Email Script versions 1.0 through 1.11

Description The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the Email parameter in the register.php file. It can be leveraged to modify cookies and conduct session fixation attacks.

Recommendations For versions 1.0 through 1.11, update the register.php file to properly sanitize the Email parameter to prevent arbitrary web script or HTML injection. As a temporary workaround, consider restricting access to the register.php file until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-7043

Affected Products

Fresh Email Script

References · 7

• 🔥 http://securityfocus.com/bid/32241 · Exploit
• 🔥 https://exploit-db.com/exploits/7080 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-7043 · Security Note
• http://secunia.com/advisories/32642 · Vendor Advisory
• http://vupen.com/english/advisories/2008/3096 · Vendor Advisory
• http://osvdb.org/49849 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46529 · Note