PT-2009-2602 · Easyimagecatalogue · Easyimagecatalogue

Published 2009-09-01 · Updated 2017-08-17 · CVE-2008-7133

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions EasyImageCatalogue version 1.3.1

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via several parameters, including the search and d index.php parameters to "index.php", the dir parameter to "thumber.php", and the d parameter to "describe.php" and "addcomment.php".

Recommendations For EasyImageCatalogue version 1.3.1, consider validating and sanitizing user input for the search, d, and dir parameters in the affected scripts to prevent arbitrary script or HTML injection. As a temporary workaround, restrict access to the vulnerable scripts until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-7133

Affected Products

Easyimagecatalogue

References · 8

• 🔥 https://exploit-db.com/exploits/31372 · Exploit
• 🔥 https://exploit-db.com/exploits/31373 · Exploit
• 🔥 http://securityfocus.com/bid/28164 · Exploit
• 🔥 https://exploit-db.com/exploits/31371 · Exploit
• 🔥 https://exploit-db.com/exploits/31374 · Exploit
• 🔥 http://downloads.securityfocus.com/vulnerabilities/exploits/28164.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-7133 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41187 · Note