PT-2009-4593 · Tbdev.Net · Tbdev.Net

Intern0T · Published 2009-06-22 · Updated 2017-09-29 · CVE-2009-2141

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TBDev.NET version 01-01-08

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through several means, including the returnto parameter to makepoll.php, the returnto parameter in a delete action to polls.php, or the Info or Avatar field to my.php.

Recommendations For TBDev.NET version 01-01-08, consider validating and sanitizing user input for the returnto parameter in makepoll.php and polls.php, as well as the Info and Avatar fields in my.php to prevent XSS attacks. As a temporary workaround, restrict access to these parameters and fields until a proper fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-2141

Affected Products

Tbdev.Net

References · 4

• 🔥 https://exploit-db.com/exploits/8942 · Exploit
• 🔥 http://forum.intern0t.net/intern0t-advisories/1121-intern0t-tbdev-01-01-2008-multiple-vulnerabilities.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2141 · Security Note
• http://secunia.com/advisories/35378 · Vendor Advisory