PT-2010-1729 · Econtact Pro · Online Contact Manager

Published 2010-07-09 · Updated 2010-07-12 · CVE-2009-4926

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Online Contact Manager (formerly EContact PRO) version 3.0

Description The issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the showGroup parameter to "/index.php" and the id parameter to "/view.php", "/email.php", "/edit.php", and "/delete.php".

Recommendations For Online Contact Manager (formerly EContact PRO) version 3.0, consider validating and sanitizing user input for the showGroup and id parameters to prevent arbitrary web script or HTML injection. As a temporary workaround, restrict access to the affected API endpoints until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-4926

Affected Products

Online Contact Manager

References · 9

• 🔥 https://exploit-db.com/exploits/32936 · Exploit
• 🔥 http://securityfocus.com/bid/34626 · Exploit
• 🔥 http://packetstorm.linuxsecurity.com/0904-exploits/ocm30-xss.txt · Exploit
• 🔥 https://exploit-db.com/exploits/32934 · Exploit
• 🔥 https://exploit-db.com/exploits/32935 · Exploit
• 🔥 https://exploit-db.com/exploits/32933 · Exploit
• 🔥 https://exploit-db.com/exploits/32937 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4926 · Security Note
• http://secunia.com/advisories/34826 · Vendor Advisory