PT-2009-5666 · Match Agency · Match Agency Biz

Published 2009-09-24 · Updated 2017-08-17 · CVE-2009-3359

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Match Agency BiZ version 1.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities are found in the important parameter to "edit profile.php" and the pid parameter to "report.php".

Recommendations For Match Agency BiZ version 1.0, as a temporary workaround, consider restricting access to the "edit profile.php" and "report.php" scripts until a patch is available. Avoid using the important parameter in "edit profile.php" and the pid parameter in "report.php" until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-3359

Affected Products

Match Agency Biz

References · 8

• 🔥 https://exploit-db.com/exploits/34600 · Exploit
• 🔥 https://exploit-db.com/exploits/34601 · Exploit
• 🔥 http://packetstormsecurity.org/0909-exploits/matchagencybiz-xss.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3359 · Security Note
• http://secunia.com/advisories/36672 · Vendor Advisory
• http://osvdb.org/57969 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53173 · Note
• http://osvdb.org/57968 · Note