PT-2012-2154 · Esyndicat · Esyndicat Pro

Published 2012-09-20 · Updated 2017-08-29 · CVE-2011-5177

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions eSyndiCat Pro version 2.3.05

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters, including the id parameter to various admin pages, such as admins, blocks, articles, or suggest-category, and the sort parameter to the search page.

Recommendations For eSyndiCat Pro version 2.3.05, consider restricting access to the admin/controller.php file until a patch is available, and avoid using the id parameter in the admins, blocks, articles, or suggest-category pages, as well as the sort parameter in the search page.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-5177

Affected Products

Esyndicat Pro

References · 5

• 🔥 http://packetstormsecurity.org/files/view/107324/esyndicatpro-xss.txt · Exploit
• 🔥 https://exploit-db.com/exploits/36362 · Exploit
• 🔥 http://securityfocus.com/bid/50822 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5177 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71485 · Note