NetArt Media Real Estate Portal 'index.php' Multiple Vulnerabilities
BID:43266
Info
NetArt Media Real Estate Portal 'index.php' Multiple Vulnerabilities
| Bugtraq ID: | 43266 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-3606 CVE-2010-3607 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 16 2010 12:00AM |
| Updated: | Apr 13 2015 09:02PM |
| Credit: | r0t |
| Vulnerable: |
NetArtMEDIA Real Estate Portal 2.0 |
| Not Vulnerable: | |
Discussion
NetArt Media Real Estate Portal 'index.php' Multiple Vulnerabilities
NetArt Media Real Estate Portal is prone to a cross-site scripting vulnerability and multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage the cross-site scripting issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
An attacker can exploit the local file-include vulnerabilities using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.
NetArt Media Real Estate Portal 2.0 is vulnerable; other versions may also be affected.
NetArt Media Real Estate Portal is prone to a cross-site scripting vulnerability and multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage the cross-site scripting issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
An attacker can exploit the local file-include vulnerabilities using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.
NetArt Media Real Estate Portal 2.0 is vulnerable; other versions may also be affected.
Exploit / POC
NetArt Media Real Estate Portal 'index.php' Multiple Vulnerabilities
Attackers can exploit these issues via a browser.
Attackers can exploit these issues via a browser.
Solution / Fix
NetArt Media Real Estate Portal 'index.php' Multiple Vulnerabilities
Solution:
Reports indicate that the cross-site scripting issue has been fixed by the vendor but Symantec has not confirmed this information.
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Reports indicate that the cross-site scripting issue has been fixed by the vendor but Symantec has not confirmed this information.
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
NetArt Media Real Estate Portal 'index.php' Multiple Vulnerabilities
References:
References:
- Real Estate Portal Homepage (NetArt Media)
- NetArt Media Real Estate Portal Multiple Vulnerabilities (r0t)