PT-2018-14992 · Jtbc · Jtbc

Published 2018-11-26 · Updated 2018-12-19 · CVE-2018-19547

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions JTBC(PHP) version 3.0.1.7

Description The issue is related to a cross-site scripting (XSS) problem. It occurs via the "console/xml/manage.php" API endpoint, specifically when the type parameter is set to "action" and the action parameter is set to "edit". The content parameter is vulnerable, allowing for potential XSS attacks.

Recommendations For JTBC(PHP) version 3.0.1.7, as a temporary workaround, consider restricting access to the "console/xml/manage.php" API endpoint, specifically when the type parameter is set to "action" and the action parameter is set to "edit", to minimize the risk of exploitation. Avoid using the content parameter in this endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-19547

Affected Products

Jtbc

References · 4

• 🔥❌ https://github.com/toiron/setest/blob/master/csrfandxss.html · Exploit, Deleted
• 🔥❌ https://github.com/toiron/setest · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2018-19547 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19547 · Security Note