PT-2009-6403 · Cutenews · Cutenews

Published 2009-12-10 · Updated 2018-10-10 · CVE-2009-4249

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CuteNews version 1.4.6

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can occur through the lastusername and mod parameters to "index.php", and the title parameter to "search.php", when register globals is enabled and magic quotes gpc is disabled.

Recommendations For CuteNews version 1.4.6, consider disabling the register globals setting and enabling magic quotes gpc to mitigate the risk of exploitation. Additionally, restrict access to the index.php and search.php files to minimize the risk of XSS attacks. Avoid using the lastusername, mod, and title parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-4249

Affected Products

Cutenews

References · 9

• 🔥 http://morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt · Exploit
• 🔥 https://exploit-db.com/exploits/33342 · Exploit
• 🔥 http://securityfocus.com/bid/36971 · Exploit
• 🔥 https://exploit-db.com/exploits/10002 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4249 · Security Note
• http://securityfocus.com/archive/1/507782/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54220 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54222 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54219 · Note