Lucene search

MitreCVE-2018-9857

HistoryApr 09, 2018 - 7:29 a.m.

CVE-2018-9857

2018-04-0907:29:00

CWE-79

mitre

web.nvd.nist.gov

cve-2018-9857

php scripts mall

match clone script

xss

searchbyid.php

view search by id

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

45.5%

JSON

PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the “View Search By Id” screen).

Affected configurations

Nvd

Node

match_clone_script_projectmatch_clone_scriptMatch1.0.4

VendorProductVersionCPE
match_clone_script_projectmatch_clone_script1.0.4cpe:2.3:a:match_clone_script_project:match_clone_script:1.0.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
match_clone_script_project	match_clone_script	1.0.4	cpe:2.3:a:match_clone_script_project:match_clone_script:1.0.4:::::::*

References

pastebin.com/Y9uEC4nu

www.exploit-db.com/exploits/44486/

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

45.5%

JSON

Related for CVE-2018-9857