PT-2021-23910 · Pictshare · Pictshare

Enferaso · Published 2021-12-02 · Updated 2021-12-03 · CVE-2021-43683

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: pictshare version 1.5

Description: The issue is related to a Cross Site Scripting (XSS) vulnerability in the "api/info.php" endpoint. The exit function will terminate the script and print a message that includes the value of the hash variable from the $ REQUEST array. This suggests that an attacker could potentially inject malicious scripts by manipulating the hash parameter.

Recommendations: For pictshare version 1.5, consider disabling the "api/info.php" endpoint until a patch is available to prevent exploitation of the XSS vulnerability. As a temporary workaround, restrict access to this endpoint to minimize the risk of exploitation. Avoid using the hash parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-43683

Affected Products

Pictshare

References · 4

• 🔥 https://github.com/HaschekSolutions/pictshare/issues/133 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-43683 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43683 · Vendor Advisory
• https://t.me/cibsecurity/33254 · Telegram Post