PT-2013-6166 · Cru · Cru Ditto Forensic Fieldstation

Martin Wundram · Published 2013-12-17 · Updated 2014-01-14 · CVE-2013-6882

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CRU Ditto Forensic FieldStation versions 2013Oct15a and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via the username parameter in a login. Additionally, remote authenticated users can inject arbitrary web script or HTML via unspecified form fields.

Recommendations For CRU Ditto Forensic FieldStation versions 2013Oct15a and earlier, update the firmware to a version later than 2013Oct15a to resolve the issue. As a temporary workaround, consider restricting access to the login functionality and unspecified form fields to minimize the risk of exploitation. Avoid using the username parameter in the affected login endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-6882

Affected Products

Cru Ditto Forensic Fieldstation

References · 8

• 🔥 https://exploit-db.com/exploits/30396 · Exploit
• 🔥 http://exploit-db.com/exploits/30396 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2013/Dec/80 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-6882 · Security Note
• http://osvdb.org/100996 · Note
• http://osvdb.org/101000 · Note
• http://packetstormsecurity.com/files/124420/Ditto-Forensic-FieldStation-2013Oct15a-XSS-CSRF-Command-Execution.html · Note
• http://secunia.com/advisories/55989 · Note