PT-2011-5130 · Joomla · Barter Sites

Chris Russell · Published 2011-12-15 · Updated 2011-12-15 · CVE-2011-4830

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Barter Sites component version 1.3 for Joomla!

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via several parameters, including listing title, description, homeurl, paystring, sell price, shipping cost, and quantity, in the com listing component. This is achieved by sending malicious input to the "index.php" endpoint.

Recommendations For Barter Sites component version 1.3, avoid using the vulnerable parameters listing title, description, homeurl, paystring, sell price, shipping cost, and quantity in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-4830

Affected Products

Barter Sites

References · 5

• 🔥 http://exploit-db.com/exploits/18046 · Exploit
• 🔥 https://exploit-db.com/exploits/18046 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4830 · Security Note
• http://docs.joomla.org/Vulnerable_Extensions_List#Barter_Sites_1.3 · Note
• http://my.barter-sites.com/index.php?option=com_content&view=article&id=6&Itemid=25 · Note