PT-2013-1974 · Netart Media · Netart Media Car Portal

The_Storm · Published 2013-01-24 · Updated 2013-01-29 · CVE-2012-6510

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NetArt Media Car Portal version 3.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via several fields, including the PWRS field, Description field when posting a new vehicle, news title when creating news, Name when creating a sub user, group name when creating a group, or dealer name, first name, or last name when changing a profile.

Recommendations For NetArt Media Car Portal version 3.0, update the software to a version that includes fixes for the cross-site scripting vulnerabilities. As a temporary workaround, consider restricting user input for the PWRS, Description, news title, Name, group name, dealer name, first name, and last name fields to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-6510

Affected Products

Netart Media Car Portal

References · 6

• 🔥 https://exploit-db.com/exploits/18801 · Exploit
• 🔥 http://packetstormsecurity.org/files/112226/Car-Portal-CMS-3.0-CSRF-XSS-Shell-Upload.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-6510 · Security Note
• http://securityfocus.com/bid/53267 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6510 · Note
• http://vulnerability-lab.com/get_content.php?id=502 · Note