PT-2009-5667 · Datemill · Datemill

Published 2009-09-24 · Updated 2017-08-17 · CVE-2009-3360

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Datemill version 1.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities are found in the "return" parameter to "photo view.php", and the "st" parameter to both "photo search.php" and "search.php".

Recommendations For Datemill version 1.0, as a temporary workaround, consider restricting access to the photo view.php, photo search.php, and search.php scripts until a patch is available. Avoid using the return parameter in photo view.php and the st parameter in photo search.php and search.php to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-3360

Affected Products

Datemill

References · 10

• 🔥 https://exploit-db.com/exploits/34548 · Exploit
• 🔥 https://exploit-db.com/exploits/34550 · Exploit
• 🔥 https://exploit-db.com/exploits/34549 · Exploit
• 🔥 http://packetstormsecurity.org/0909-exploits/datemill-xss.txt · Exploit
• http://secunia.com/advisories/36608 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3360 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53177 · Note
• http://osvdb.org/57990 · Note
• http://osvdb.org/57991 · Note
• http://osvdb.org/57989 · Note