PT-2009-5597 · Php+2 · Php Rss Builder+5

Takayoshi Isayama · Published 2009-09-22 · Updated 2009-09-22 · CVE-2009-3283

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpspot PHP BBS versions prior to 20090914 PHP Image Capture BBS versions prior to 20090914 PHP & CSS BBS versions prior to 20090914 PHP BBS CE versions prior to 20090914 PHP RSS Builder versions prior to 20090914 webshot versions prior to 20090914

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to cookies.

Recommendations For phpspot PHP BBS versions prior to 20090914, update to a version released after 20090914. For PHP Image Capture BBS versions prior to 20090914, update to a version released after 20090914. For PHP & CSS BBS versions prior to 20090914, update to a version released after 20090914. For PHP BBS CE versions prior to 20090914, update to a version released after 20090914. For PHP RSS Builder versions prior to 20090914, update to a version released after 20090914. For webshot versions prior to 20090914, update to a version released after 20090914.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-3283

Affected Products

Php & Css Bbs

Php Bbs Ce

Php Image Capture Bbs

Php Rss Builder

Phpspot Php Bbs

Webshot

References · 5

• http://secunia.com/advisories/36783 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3283 · Security Note
• http://jvn.jp/en/jp/JVN53591199/index.html · Note
• http://phpspot.net/php/pg2009%94N9%8C%8E%20PHP%83X%83N%83%8A%83v%83g%82%CC%90%C6%8E%E3%90%AB.html · Note
• http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000063.html · Note