CVE-2010-2718

Sažetak

Multiple cross-site scripting (XSS) vulnerabilities in CruxSoftware CruxPA 2.00, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) txtusername parameter to login.php, (2) todo parameter to newtodo.php, and unspecified vectors to (3) newtelephone.php and (4) newappointment.php.

Reference

http://packetstormsecurity.org/1007-exploits/cruxpa-xss.txt
http://www.htbridge.ch/advisory/xss_vulnerability_in_cruxpa.html
http://www.htbridge.ch/advisory/xss_vulnerability_in_cruxpa_1.html
http://www.htbridge.ch/advisory/xss_vulnerability_in_cruxpa_2.html
http://www.htbridge.ch/advisory/xss_vulnerability_in_cruxpa_3.html
http://www.securityfocus.com/archive/1/512243/100/0/threaded
http://www.securityfocus.com/bid/41495
http://www.vupen.com/english/advisories/2010/1709

CVSS

Base:	4.3
Impact:	2.9
Exploitability:	8.6

Pristup

Vektor	Složenost	Autentikacija
NETWORK	MEDIUM	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
NONE	PARTIAL	NONE

CVSS vektor

AV:N/AC:M/Au:N/C:N/I:P/A:N

Zadnje važnije ažuriranje

10-10-2018 - 19:59

Objavljeno

13-07-2010 - 18:30