gsasec.blogspot.com
http://gsasec.blogspot.com/2009/05/vanilla-v117-cross-site-scripting.html CVE-2009-1845
Lussumo Vanilla 1.1.5/1.1.7 - 'updatecheck.php' Cross-Site Scripting
Record summary
CVE-2009-1845 has a selected CVSS score of 4.3; EIP currently links 1 catalogued exploit.
Description
Cross-site scripting (XSS) vulnerability in ajax/updatecheck.php in Lussumo Vanilla 1.1.5 and 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the RequestName parameter.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBLussumo Vanilla 1.1.5/1.1.7 - 'updatecheck.php' Cross-Site ScriptingExploitDB exploitby Gerendi Sandor AttilaNot analyzed1 file
References
5lussumo.comConfirmation
http://lussumo.com/community/discussion/9524/vanilla-118-released 35234Third-party advisory
http://secunia.com/advisories/35234 20090527 Vanilla v.1.1.7 Cross-Site Scriptingmailing list
http://www.securityfocus.com/archive/1/503847/100/0/threaded nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2009-1845