PT-2014-8757 · Phpsound · Phpsound

Published 2014-11-17 · Updated 2015-08-06 · CVE-2014-8954

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpSound version 1.0.5

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific fields, including the Title or Description fields in a playlist, or the filter parameter in an explore action to "index.php".

Recommendations For phpSound version 1.0.5, consider restricting user input for the Title and Description fields in playlists and the filter parameter in explore actions to prevent arbitrary web script or HTML injection until a patch is available. As a temporary workaround, disabling the ability to input HTML in these fields can help mitigate the risk.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-8954

Affected Products

Phpsound

References · 5

• 🔥 http://packetstormsecurity.com/files/129104/phpSound-Music-Sharing-Platform-1.0.5-Cross-Site-Scripting.html · Exploit
• 🔥 http://exploit-db.com/exploits/35198 · Exploit
• 🔥 https://exploit-db.com/exploits/35198 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8954 · Security Note
• http://securityfocus.com/bid/71172 · Note