Lucene search
RootSSV:61791HistoryMar 13, 2014 - 12:00 a.m.
Open Classifieds跨站脚本漏洞
2014-03-1300:00:00
Root
www.seebug.org
14
0.002 Low
EPSS
Percentile
54.6%
CVE ID：CVE-2014-2024
Open Classifieds可以用来创建分类和目录。
由于没有充分过滤通过URI传递到"/shared-apartments-rooms/" URL的用户提供的数据，远程攻击者可以利用漏洞欺骗登录用户访问恶意链接，并在受影响网站上下文的浏览器中执行任意HTML和脚本代码。
0
Open Classifieds 2-2.1.2
厂商补丁：
Open Classifieds
Open Classifieds 2-2.1.3版本以修复此漏洞，建议用户下载使用：
https://github.com/open-classifieds/openclassifieds2/issues/556
https://github.com/open-classifieds/openclassifieds2/commit/45ee8fb601a91b8a4238229580a32a4fd8d96ef9
The exploitation example below uses the JavaScript "alert()" function to display "immuniweb" word:
http://[host]/shared-apartments-rooms/</title><script>alert(%22immuniweb%22)</script>
Related
prion
prion
Cross site scripting
2014-03-14 14:55:00
cve
cve
CVE-2014-2024
2014-03-14 14:55:00
securityvulns
securityvulns
Cross-Site Scripting (XSS) in Open Classifieds
2014-05-04 00:00:00
cvelist
cvelist
CVE-2014-2024
2014-03-14 14:00:00
zdt
zdt
Open Classifieds 2-2.1.2 Cross Site Scripting Vulnerability
2014-03-13 00:00:00
packetstorm
packetstorm
Open Classifieds 2-2.1.2 Cross Site Scripting
2014-03-12 00:00:00
htbridge
htbridge
Cross-Site Scripting (XSS) in Open Classifieds
2014-02-19 00:00:00