咬定青山不放松,立根原在破岩中。千磨万击还坚劲,任尔东西南北风

© 竹意 | Powered by LOFTER

【转载】CVE-2014-9561 Softbb.net SoftBB XSS (Cross-Si

来自:whitehat

CVE-2014-9561  Softbb.net SoftBB XSS (Cross-Site Scripting) Security Vulnerability





Exploit Title: Softbb.net SoftBB /redir_last_post_list.php post Parameter XSS

Product: SoftBB (mods)

Vendor: Softbb.net

Vulnerable Versions: v0.1.3

Tested Version: v0.1.3

Advisory Publication: Jan 10, 2015

Latest Update: Jan 10, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-9561

CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6 

Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU), Singapore]







Advisory Details:



Vendor URL:

http://www.softbb.net/




(2) Vulnerability Details:

Softbb.net SoftBB can be exploited by XSS Attacks.



(2.1) The vulnerability occurs at “/redir_last_post_list.php" page, with “&post” parameter.








References:

http://tetraph.com/security/cves/cve-2014-9561-softbb-net-softbb-xss-cross-site-scripting-security-vulnerability/

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9561

http://www.cnvd.org.cn/flaw/show/CNVD-2015-00352

http://cve.scap.org.cn/CVE-2014-9561.html

http://packetstormsecurity.com/files/author/11270/

http://seclists.org/fulldisclosure/2015/Jan/21

http://blog.163.com/greensun_2006/blog/static/1112211220151105202951/

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9561

http://en.hackdig.com/wap/?id=12956

http://static-173-79-223-25.washdc.fios.verizon.net/?a=139222176300014&r=1&w=2

http://mathswift.blogspot.com/2015/02/cve-2014-9561-softbbnet-softbb-xss.html

http://lists.kde.org/?a=139222176300014&r=1&w=2

http://marc.info/?a=139222176300014&r=1&w=4

https://itinfotechnology.wordpress.com/2015/02/10/cve-2014-9561-softbb-net-softbb-xss-cross-site-scripting-security-vulnerability/

 

 

 

 
评论
 
回到顶部