CVE-2009-2780

Multiple cross-site scripting (XSS) vulnerabilities in 68 Classifieds 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to category.php, view parameter to (2) login.php and (3) viewlisting.php, page parameter to (4) searchresults.php and (5) toplistings.php, and (6) member parameter to viewmember.php.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://packetstormsecurity.org/0907-exploits/68classifieds-xss.txt	Exploit
http://www.osvdb.org/56565	Exploit
http://www.osvdb.org/56569	Exploit
http://www.osvdb.org/56567	Exploit
http://www.osvdb.org/56568	Exploit
http://www.osvdb.org/56564	Exploit
http://www.osvdb.org/56566	Exploit
http://secunia.com/advisories/36034	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/52071

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:68_classifieds:68_classifieds:4.1:*:*:*:*:*:*:*

Information

Published : 2009-08-17 09:30

Updated : 2017-08-16 18:30

NVD link : CVE-2009-2780

Mitre link : CVE-2009-2780

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

68_classifieds

68_classifieds

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://packetstormsecurity.org/0907-exploits/68classifieds-xss.txt", "name": "http://packetstormsecurity.org/0907-exploits/68classifieds-xss.txt", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://www.osvdb.org/56565", "name": "56565", "tags": ["Exploit"], "refsource": "OSVDB"}, {"url": "http://www.osvdb.org/56569", "name": "56569", "tags": ["Exploit"], "refsource": "OSVDB"}, {"url": "http://www.osvdb.org/56567", "name": "56567", "tags": ["Exploit"], "refsource": "OSVDB"}, {"url": "http://www.osvdb.org/56568", "name": "56568", "tags": ["Exploit"], "refsource": "OSVDB"}, {"url": "http://www.osvdb.org/56564", "name": "56564", "tags": ["Exploit"], "refsource": "OSVDB"}, {"url": "http://www.osvdb.org/56566", "name": "56566", "tags": ["Exploit"], "refsource": "OSVDB"}, {"url": "http://secunia.com/advisories/36034", "name": "36034", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52071", "name": "68classifieds-multiple-xss(52071)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in 68 Classifieds 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to category.php, view parameter to (2) login.php and (3) viewlisting.php, page parameter to (4) searchresults.php and (5) toplistings.php, and (6) member parameter to viewmember.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2009-2780", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2009-08-17T16:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:68_classifieds:68_classifieds:4.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-17T01:30Z"}