CVE-2014-8752 JCE-Tech “Video Niche Script" XSS (Cross-Site Scripting) Security Vulnerability

Math Fascinated

CVE-2014-8752 JCE-Tech “Video Niche Script" XSS (Cross-Site Scripting) Security Vulnerability
 
 
Exploit Title: JCE-Tech “Video Niche Script" /view.php Multiple Parameters XSS
Product: “Video Niche Script"
Vendor: JCE-Tech
Vulnerable Versions: 4.0
Tested Version: 4.0
Advisory Publication: Nov 18, 2014
Latest Update: Nov 18, 2014
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-8752
CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6 
Credit: Wang Jing [CCRG, Nanyang Technological University, Singapore]
 
 
 
 
 
 
Advisory Details:
 
(1) Vendor URL:
 
Product Description:
“The PHP Video Script instantly creates a niche video site based on keywords users control via the admin console. The videos are displayed on users’ site, but streamed from the YouTube servers."
 
 
 
 
(2) Vulnerability Details.
 
JCE-Tech “Video Niche Script" has a security problem. It is vulnerable to XSS attacks.
 
 
(2.1)

View original post 詳見內文:約36字

廣告

發表迴響

在下方填入你的資料或按右方圖示以社群網站登入:

WordPress.com Logo

您的留言將使用 WordPress.com 帳號。 登出 / 變更 )

Twitter picture

您的留言將使用 Twitter 帳號。 登出 / 變更 )

Facebook照片

您的留言將使用 Facebook 帳號。 登出 / 變更 )

Google+ photo

您的留言將使用 Google+ 帳號。 登出 / 變更 )

連結到 %s