PT-2020-20426 · Codoforum · Codoforum

Published 2020-02-16 · Updated 2020-02-18 · CVE-2020-9007

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Codoforum version 4.8.8

Description The issue allows self-XSS via the title of a new topic. This means an attacker can inject malicious code into the title, potentially leading to the execution of unwanted scripts when the title is viewed.

Recommendations For Codoforum version 4.8.8, as a temporary workaround, consider validating and sanitizing the title input to prevent malicious code injection until a patch is available. Restrict access to creating new topics to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-9007

Affected Products

Codoforum

References · 4

• 🔥 https://github.com/matuhn/Research/blob/master/codoforum/readme.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-9007 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9007 · Vendor Advisory
• https://t.me/cvenotify/1057 · Telegram Post