Vulnerability CVE-2018-5479

Vulnerability CVE-2018-5479

Published: 2018-01-15

Description:

FoxSash ImgHosting 1.5 (according to footer information) is vulnerable to XSS attacks. The affected function is its search engine via the search parameter to the default URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admin(s). By sending users an infected URL, code will be executed.

See advisories in our WLB2 database:

	Topic	Author	Date
Low	ImgHosting 1.5 Cross Site Scripting	Dennis Veninga	16.01.2018

Type:

CWE-79

(Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
4.3/10	2.9/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
None	Partial	None

Affected software
Foxsash -> Imghosting

References:

https://www.exploit-db.com/exploits/43567/

Copyright 2024, cxsecurity.com