PT-2010-4349 · Unknown · Event Horizon

Published 2010-07-23 · Updated 2010-07-26 · CVE-2010-2854

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Event Horizon (EVH) version 1.1.10

Description The issue allows remote attackers to inject arbitrary web script or HTML via the YourEmail and VerificationNumber parameters in modfile.php, which are not properly handled in a forced SQL error message when magic quotes gpc is disabled.

Recommendations For Event Horizon (EVH) version 1.1.10, consider disabling the YourEmail and VerificationNumber parameters in modfile.php until a patch is available, or ensure that magic quotes gpc is enabled to prevent exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-2854

Affected Products

Event Horizon

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2010-2854 · Security Note
• http://secunia.com/advisories/40517 · Vendor Advisory
• http://freshmeat.net/projects/eventh · Note