PT-2017-12552 · Socusoft · Socusoft Flash Slideshow Maker Professional

Published 2017-08-05 · Updated 2020-08-19 · CVE-2017-12439

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SocuSoft Flash Slideshow Maker Professional versions prior to v5.21

Description The issue arises when the advanced configuration is used, and the xml path HTTP parameter trusts user-supplied input. This is compounded by an unsafe XML configuration file, leading to content forgery, cross-site scripting, and unvalidated redirection issues. The xml path parameter is vulnerable to user input, which can be exploited.

Recommendations For SocuSoft Flash Slideshow Maker Professional versions prior to v5.21, as a temporary workaround, consider restricting access to the xml path HTTP parameter to minimize the risk of exploitation. Avoid using the xml path parameter in the affected configuration until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-12439

Affected Products

Socusoft Flash Slideshow Maker Professional

References · 3

• 🔥 https://packetstormsecurity.com/files/143542/Flash-Slideshow-Maker-Professional-XSS-Content-Forgery-Redirect.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-12439 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12439 · Security Note