PT-2021-17387 · 4Images · 4Images

Published 2021-03-22 · Updated 2024-03-06 · CVE-2021-27308

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions 4images version 1.8

Description A cross-site scripting (XSS) issue exists in the admin login panel, allowing remote attackers to inject JavaScript via the redirect parameter.

Recommendations For 4images version 1.8, consider restricting access to the admin login panel until a fix is available, and avoid using the redirect parameter in the affected API endpoint.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-RUM-2021-27308

CVE-2021-27308

Affected Products

4Images

References · 8

• 🔥 https://github.com/4images/4images/issues/3 · Exploit
• 🔥 http://packetstormsecurity.com/files/162946/4Images-1.8-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/49945 · Exploit
• https://osv.dev/vulnerability/BIT-rum-2021-27308 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27308 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27308 · Security Note
• https://t.me/cibsecurity/25229 · Telegram Post
• https://t.me/cvenotify/11874 · Telegram Post