PT-2021-3446 · Icecoder · Icecoder

Seongil Wi · Published 2021-06-08 · Updated 2021-09-16 · CVE-2021-32106

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions ICEcoder version 8.0

Description A reflected XSS issue was identified in the multipe-results.php page due to insufficient sanitization of the replace variable. This allows arbitrary Javascript code to be executed, potentially enabling remote attackers to perform cross-site scripting attacks.

Recommendations For ICEcoder version 8.0, consider disabling access to the multipe-results.php page or restricting the use of the replace variable until a patch is available. Additionally, ensure proper sanitization of user input to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-03306

CVE-2021-32106

GHSA-JF9V-Q8VH-3FMC

Affected Products

Icecoder

References · 10

• 🔥 https://groups.google.com/g/icecoder/c/xcAc8_1UPxQ · Exploit
• https://bdu.fstec.ru/vul/2021-03306 · Security Note
• https://osv.dev/vulnerability/GHSA-jf9v-q8vh-3fmc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32106 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32106 · Vendor Advisory
• https://github.com/icecoder/ICEcoder · Note
• https://github.com/icecoder/ICEcoder/commit/21d6ae0f2a3fce7d076ae430d48f5df56bd0f256 · Note
• https://prophaze.com/cve/icecoder-8-0-multipe-results-php-replace-cross-site-scripting · Note
• https://t.me/cvenotify/20975 · Telegram Post
• https://t.me/cvenotify/15831 · Telegram Post