PT-2009-5112 · Achievo · Achievo

Published 2009-10-16 · Updated 2018-10-10 · CVE-2009-2733

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Achievo versions prior to 1.4.0

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through the scheduler title in the scheduler module or via specific parameters to the Organization Contracts administration page, including atksearch[contractnumber], atksearch AE customer[customer], atksearchmode[contracttype], and possibly atksearch[contractname], which are accessible through the "dispatch.php" endpoint.

Recommendations For versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the scheduler module and the Organization Contracts administration page, and avoid using the vulnerable parameters until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-2733

Affected Products

Achievo

References · 12

• 🔥 http://securityfocus.com/bid/36661 · Exploit
• 🔥 http://bonsai-sec.com/research/vulnerabilities/achievo-multiple-xss-0101.txt · Exploit
• 🔥 https://exploit-db.com/exploits/9863 · Exploit
• 🔥 https://exploit-db.com/exploits/33281 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2733 · Security Note
• http://secunia.com/advisories/37035 · Vendor Advisory
• http://achievo.org/download/releasenotes/1_4_0 · Patch
• http://bonsai-sec.com/blog/index.php/cross-site-scripting-payloads · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53745 · Note
• http://securityfocus.com/archive/1/507133/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53744 · Note
• http://securitytracker.com/id?1023017 · Note