PT-2009-6599 · Xstate · Xstate Real Estate

Moudi · Published 2009-12-30 · Updated 2017-09-19 · CVE-2009-4478

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Xstate Real Estate version 1.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to specific endpoints, such as "home.html" or "lands.html". This can lead to cross-site scripting (XSS) attacks.

Recommendations For Xstate Real Estate version 1.0, update the software to prevent remote attackers from injecting arbitrary web script or HTML. As a temporary workaround, consider restricting access to the "home.html" and "lands.html" endpoints until a patch is available. Avoid using the PATH INFO to inject user-controlled input in these endpoints.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-4478

Affected Products

Xstate Real Estate

References · 7

• 🔥 http://osvdb.org/57671 · Exploit
• 🔥 http://osvdb.org/57672 · Exploit
• 🔥 https://exploit-db.com/exploits/9565 · Exploit
• 🔥 http://exploit-db.com/exploits/9565 · Exploit
• http://secunia.com/advisories/36529 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4478 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52970 · Note