CVE-2008-5584

Multiple cross-site scripting XSS vulnerabilities in ProjectPier 0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 a message, 2 a milestone, or 3 a display name in a profile, or the 4 a or 5 c parameter to index.php...

CVE-2008-5583

The CVE-2008-5583 entry describes a cross-site request forgery in ProjectPier 0.8 and earlier, where an attacker can cause actions as an administrator through the index.php query string (e.g., delete project). Affected software: ProjectPier 0.8 and earlier. Root cause: CSRF in index.php allowing ...

CVE-2008-5584

CVE-2008-5584 affects ProjectPier ≤0.8, with multiple XSS vectors in index.php: (1) message, (2) milestone, (3) display name in a profile, and (4)/(5) a or c parameters. This allows remote injection of arbitrary script/HTML. No explicit patch/version remediation is provided in the connected docum...

PT-2008-6645 · Projectpier · Projectpier

Name of the Vulnerable Software and Affected Versions: ProjectPier versions 0.8 and earlier Description: The issue allows remote attackers to inject arbitrary web script or HTML via various means, including a message, a milestone, or a display name in a profile, or the a or c parameter to...

PT-2008-6644 · Projectpier · Projectpier

Name of the Vulnerable Software and Affected Versions: ProjectPier versions 0.8 and earlier Description: A cross-site request forgery issue allows remote attackers to perform actions as an administrator via the query string, such as a delete project action. Recommendations: For ProjectPier versio...

CVE-2008-5584: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ProjectPier 0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 a message, 2 a milestone, or 3 a display name in a profile, or the 4 a or 5 c parameter to index.php...

CVE-2008-5583: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in index.php in ProjectPier 0.8 and earlier allows remote attackers to perform actions as an administrator via the query string, as demonstrated by a delete project action...

projectpier-xssxsrf.txt

====================================================================== ProjectPier Impact: Cross Site Scripting Cross Site Request Forgery Status: patch available ------------------------------ Affected software description: ------------------------------ Application: ProjectPier Version: = 0.80...

ProjectPier <= 0.80 Cross Site Scripting and Request Forgery

====================================================================== ProjectPier = 0.80 Cross Site Scripting and Request Forgery ====================================================================== Author: L4teral l4teral 4t gmail com Impact: Cross Site Scripting Cross Site Request Forgery...

ProjectPier index.php Multiple Parameter XSS

The remote host is running ProjectPier, an open source project management tool written in PHP. The version of ProjectPier installed on the remote host fails to sanitize user input to the 'refc' and 'refa' parameters of the 'index.php' script before using it to generate dynamic HTML output. An...

ProjectPier 0.8 - Multiple HTML Injection Cross-Site Scripting Vulnerabilities

ProjectPier 0.8 - Multiple HTML Injection Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/27857/info ProjectPier is prone to multiple HTML-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker m...

ProjectPier 0.8 - Multiple HTML Injection / Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/27857/info ProjectPier is prone to multiple HTML-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an...