PT-2015-4263 · Papoo · Cms Papoo Light

Published 2015-01-05 · Updated 2018-10-09 · CVE-2014-9522

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CMS Papoo Light version 6.0.0 (Rev 4701)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the author field to "guestbook.php" and the username field to "account.php" are vulnerable.

Recommendations For CMS Papoo Light version 6.0.0 (Rev 4701), consider disabling the guestbook.php and account.php scripts until a patch is available to prevent exploitation through the author and username fields. Restrict access to these scripts to minimize the risk of XSS attacks. Avoid using the author field in "guestbook.php" and the username field in "account.php" until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-9522

Affected Products

Cms Papoo Light

References · 8

• 🔥 http://exploit-db.com/exploits/35551 · Exploit
• 🔥 https://exploit-db.com/exploits/35551 · Exploit
• 🔥 http://sroesemann.blogspot.de/2014/12/bericht-zu-advisory-sroeadv-2014-01.html · Exploit
• 🔥 http://packetstormsecurity.com/files/129586/CMS-Papoo-6.0.0-Revision-4701-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9522 · Security Note
• http://osvdb.org/show/osvdb/115944 · Note
• http://securityfocus.com/archive/1/534243/100/0/threaded · Note
• http://securityfocus.com/bid/71676 · Note