PT-2014-8898 · Websitebaker · Websitebaker

Manuel Garcia Cardenas · Published 2014-12-03 · Updated 2014-12-05 · CVE-2014-9243

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebsiteBaker version 2.8.3

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the QUERY STRING to "wb/admin/admintools/tool.php" or the section id parameter to several files in the wb/modules/ directory, including "edit module files.php", "news/add post.php", "news/modify group.php", "news/modify post.php", and "news/modify settings.php".

Recommendations For WebsiteBaker version 2.8.3, consider disabling access to the vulnerable API endpoints and parameters, such as the QUERY STRING to "wb/admin/admintools/tool.php" and the section id parameter in the affected files, until a patch is available. Restrict access to the vulnerable modules in the wb/modules/ directory to minimize the risk of exploitation. Avoid using the section id parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-9243

Affected Products

Websitebaker

References · 5

• 🔥 http://packetstormsecurity.com/files/129140/WebsiteBaker-2.8.3-XSS-SQL-Injection-HTTP-Response-Splitting.html · Exploit
• 🔥 https://exploit-db.com/exploits/35277 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Nov/44 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9243 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9243 · Note