PT-2010-1591 · Theeta · Theeta Cms

Published 2010-04-21 · Updated 2018-10-10 · CVE-2009-4782

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Theeta CMS version 0.01

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters to various PHP files. The vulnerable parameters include start, forum, and cat in community/thread.php, start and cat in community/forum.php, and start in blog/index.php.

Recommendations For Theeta CMS version 0.01, consider restricting access to the community/thread.php, community/forum.php, and blog/index.php files until a patch is available. As a temporary workaround, avoid using the start, forum, and cat parameters in the affected API endpoints.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-4782

Affected Products

Theeta Cms

References · 5

• 🔥 https://exploit-db.com/exploits/10290 · Exploit
• 🔥 http://packetstormsecurity.org/0912-exploits/theeta-sqlxss.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4782 · Security Note
• http://secunia.com/advisories/37529 · Vendor Advisory
• http://securityfocus.com/archive/1/508148/100/0/threaded · Note