PT-2010-3844 · Phpbannerexchange · Phpbannerexchange

Published 2010-06-09 · Updated 2017-11-20 · CVE-2010-2258

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpBannerExchange version 1.2 Arabic

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the bannerurl parameter in the signupconfirm.php file.

Recommendations For phpBannerExchange version 1.2 Arabic, avoid using the bannerurl parameter in the signupconfirm.php file until a fix is available. As a temporary workaround, consider validating and sanitizing all user input to the bannerurl parameter to prevent malicious script injection.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-2258

Affected Products

Phpbannerexchange

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-2258 · Security Note
• http://packetstormsecurity.org/1001-exploits/phpbannerexchange-xss.txt · Note
• http://secunia.com/advisories/38022 · Note
• http://osvdb.org/61446 · Note