PT-2009-5397 · Unknown · Property Watch

Published 2009-09-03 · Updated 2009-09-09 · CVE-2009-3066

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Property Watch version 2.0

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the videoid parameter to "tools/email.php" and the redirect parameter to "tools/login.php" are vulnerable.

Recommendations: For version 2.0, consider restricting access to the videoid parameter in the "tools/email.php" endpoint and the redirect parameter in the "tools/login.php" endpoint to minimize the risk of exploitation. Avoid using these parameters until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-3066

Affected Products

Property Watch

References · 5

• 🔥 https://exploit-db.com/exploits/34473 · Exploit
• 🔥 https://exploit-db.com/exploits/34474 · Exploit
• 🔥 http://packetstormsecurity.org/0909-exploits/propertywatch-xss.txt · Exploit
• http://secunia.com/advisories/36548 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3066 · Security Note