PT-2009-4276 · Mygesuad · Mygesuad

Yenh4Cker · Published 2009-05-29 · Updated 2017-09-29 · CVE-2009-1811

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: myGesuad version 0.9.14

Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various parameters in different modules, including the Page parameter in a List action to "modules/ereignis.php", the Kontext parameter in a Search action to "modules/kategorie.php", the image parameter to "modules/image.php", or the ID parameter in a Detail action to "modules/sitzung.php".

Recommendations: For myGesuad version 0.9.14, consider disabling the affected modules (ereignis.php, kategorie.php, image.php, sitzung.php) until a patch is available. Restrict access to these modules to minimize the risk of exploitation. Avoid using the parameters Page, Kontext, image, and ID in the respective API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-1811

Affected Products

Mygesuad

References · 5

• 🔥 http://securityfocus.com/bid/34998 · Exploit
• 🔥 https://exploit-db.com/exploits/8708 · Exploit
• http://secunia.com/advisories/35136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1811 · Security Note
• http://vupen.com/english/advisories/2009/1345 · Note