Multiple phpspot Products Unspecified Cross Site Scripting and Directory Traversal Vulnerabilities
BID:42345
Info
Multiple phpspot Products Unspecified Cross Site Scripting and Directory Traversal Vulnerabilities
| Bugtraq ID: | 42345 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-3283 CVE-2009-3284 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 18 2009 12:00AM |
| Updated: | Sep 18 2009 12:00AM |
| Credit: | Takayoshi Isayama of Mitsui Bussan Secure Directions, Inc. |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Multiple phpspot Products Unspecified Cross Site Scripting and Directory Traversal Vulnerabilities
Multiple phpspot products are prone to an unspecified directory-traversal vulnerability and an unspecified cross-site scripting vulnerability because they fail to sufficiently sanitize user-supplied input.
Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or view arbitrary files in the context of the application. Other attacks are also possible.
Multiple phpspot products are prone to an unspecified directory-traversal vulnerability and an unspecified cross-site scripting vulnerability because they fail to sufficiently sanitize user-supplied input.
Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or view arbitrary files in the context of the application. Other attacks are also possible.
Exploit / POC
Multiple phpspot Products Unspecified Cross Site Scripting and Directory Traversal Vulnerabilities
Attackers can exploit these issues via a browser. To exploit the cross-site scripting issue the attacker must entice an unsuspecting victim into follow a malicious URI.
Attackers can exploit these issues via a browser. To exploit the cross-site scripting issue the attacker must entice an unsuspecting victim into follow a malicious URI.
Solution / Fix
Multiple phpspot Products Unspecified Cross Site Scripting and Directory Traversal Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Multiple phpspot Products Unspecified Cross Site Scripting and Directory Traversal Vulnerabilities
References:
References:
- phpspot Homepage (phpspot)
- September 2009 PHP Script Vulnerability (phpspot)