PT-2021-23914 · Imanage · Manage

Enferas · Published 2021-12-01 · Updated 2021-12-02 · CVE-2021-43689

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: manage version (last update Oct 24, 2017)

Description: The issue is related to a Cross Site Scripting (XSS) vulnerability in the Application/Home/Controller/GoodsController.class.php file. This vulnerability allows for the termination of the script and the printing of a message that includes values from the $ POST variable.

Recommendations: For the manage version (last update Oct 24, 2017), as a temporary workaround, consider restricting access to the GoodsController.class.php file until a patch is available. Additionally, avoid using the exit function with user-supplied input from $ POST to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-43689

Affected Products

Manage

References · 4

• 🔥 https://github.com/yicenburan/manage/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-43689 · Security Note
• https://t.me/cibsecurity/33202 · Telegram Post
• https://t.me/cvenotify/24091 · Telegram Post