ProjectSend Multiple Security Vulnerabilities
BID:74374
Info
ProjectSend Multiple Security Vulnerabilities
| Bugtraq ID: | 74374 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 28 2015 12:00AM |
| Updated: | Apr 28 2015 12:00AM |
| Credit: | TUNISIAN CYBER |
| Vulnerable: |
ProjectSend ProjectSend 561 |
| Not Vulnerable: | |
Discussion
ProjectSend Multiple Security Vulnerabilities
ProjectSend is prone to the following security vulnerabilities:
1. Multiple cross-site scripting vulnerabilities
2. Multiple cross-site request-forgery vulnerabilities
3. An arbitrary file-upload vulnerability
An attacker may leverage these issues to perform unauthorized actions in the context of a user's session, execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials and to upload arbitrary files to the affected application.
ProjectSend version 561 is vulnerable; other versions may also be affected.
ProjectSend is prone to the following security vulnerabilities:
1. Multiple cross-site scripting vulnerabilities
2. Multiple cross-site request-forgery vulnerabilities
3. An arbitrary file-upload vulnerability
An attacker may leverage these issues to perform unauthorized actions in the context of a user's session, execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials and to upload arbitrary files to the affected application.
ProjectSend version 561 is vulnerable; other versions may also be affected.