PT-2009-5541 · Almondsoft · Almond Classifieds+1

Published 2009-09-16 · Updated 2009-09-17 · CVE-2009-3225

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AlmondSoft Almond Classifieds Wap and Pro versions (affected versions not specified) Almond Affiliate Network Classifieds versions (affected versions not specified)

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the page parameter in a browse action to "index.php" or the addr parameter to "gmap.php".

Recommendations For AlmondSoft Almond Classifieds Wap and Pro, as a temporary workaround, consider restricting access to the "index.php" and "gmap.php" files until a patch is available. For Almond Affiliate Network Classifieds, avoid using the page and addr parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-3225

Affected Products

Almond Affiliate Network Classifieds

Almond Classifieds

References · 6

• 🔥 http://securityfocus.com/bid/35816 · Exploit
• 🔥 http://packetstormsecurity.org/0907-exploits/almondclassifieds-xss.txt · Exploit
• 🔥 https://exploit-db.com/exploits/33117 · Exploit
• 🔥 https://exploit-db.com/exploits/33116 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3225 · Security Note
• http://secunia.com/advisories/36003 · Vendor Advisory