PT-2010-4646 · Iwiccle · Wiccle Web Builder

Published 2010-09-03 · Updated 2017-08-17 · CVE-2010-3208

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Wiccle Web Builder (WWB) versions 1.00 through 1.0.1

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the post text parameter in a site custom search action to "index.php".

Recommendations For versions 1.00 and 1.0.1, consider restricting access to the "index.php" endpoint or avoid using the post text parameter in the custom search action until a fix is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-3208

Affected Products

Wiccle Web Builder

References · 5

• 🔥 http://packetstormsecurity.com/1008-exploits/wiccle-xss.txt · Exploit
• http://secunia.com/advisories/41191 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3208 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61466 · Note
• http://osvdb.org/67691 · Note