PT-2010-3846 · Gambit Design · Gambit Design Bandwidth Meter

Published 2010-06-09 · Updated 2017-08-17 · CVE-2010-2260

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Gambit Design Bandwidth Meter versions 0.72 through 1.2

Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to (1) "view by name.php" or (2) "view by ip.php" in the "admin/" directory.

Recommendations For Gambit Design Bandwidth Meter versions 0.72 through 1.2, consider restricting access to the "view by name.php" and "view by ip.php" files in the "admin/" directory until a fix is available. Avoid using the PATH INFO to inject web script or HTML in these files.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-2260

Affected Products

Gambit Design Bandwidth Meter

References · 5

• 🔥 http://packetstormsecurity.org/1001-exploits/bandwidthmeter-xss.txt · Exploit
• 🔥 http://exploit-db.com/exploits/10926 · Exploit
• http://secunia.com/advisories/38012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2260 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55307 · Note