PT-2019-9648 · Unknown · Advanced Comment System

Rafael Pedrero · Published 2019-03-17 · Updated 2019-03-27 · CVE-2018-18845

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advanced Comment System version 1.0

Description The issue allows a remote unauthenticated attacker to potentially exploit a reflected cross-site scripting vulnerability via the ACS path variable. This could lead to the supply of malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser.

Recommendations For Advanced Comment System version 1.0, as the product is discontinued, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-18845

Affected Products

Advanced Comment System

References · 4

• 🔥 http://seclists.org/fulldisclosure/2019/Feb/46 · Exploit
• 🔥 http://packetstormsecurity.com/files/151799/Advanced-Comment-System-1.0-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18845 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18845 · Vendor Advisory