PT-2021-4030 · Unknown · Ctparental

Published 2021-08-10 · Updated 2021-08-13 · CVE-2021-37365

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CTparental versions prior to 4.45.03

Description The issue is related to cross-site scripting (XSS) in the CTparental admin panel. Specifically, in the bl categires help.php file, the categories variable is assigned with the content of the query string parameter cat without proper sanitization or encoding. This enables an attacker to inject malicious code into the output webpage. There is also a mention of a vulnerability due to incorrect restriction of a directory path name with limited access, which could allow an attacker to inject arbitrary code.

Recommendations For CTparental versions prior to 4.45.03, update to version 4.45.03 or later to resolve the issue. As a temporary workaround, consider disabling access to the bl categires help.php file or restricting the use of the categories variable until a patch is applied. Additionally, avoid using the cat parameter in the affected query string until the issue is resolved.

Fix

XSS

Path traversal

Weakness Enumeration

CWE-79

CWE-22

Related Identifiers

BDU:2021-04557

CVE-2021-37365

Affected Products

Ctparental

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-37365 · Security Note
• https://bdu.fstec.ru/vul/2021-04557 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37365 · Vendor Advisory
• https://t.me/cvenotify/19296 · Telegram Post
• https://gitlab.com/marsat/CTparental · Note
• https://t.me/cibsecurity/27089 · Telegram Post
• https://gist.github.com/securylight/092ba96a660e07ad76f2a380c2eaa75a · Note