CVE-2014-8752 JCE-Tech "Video Niche Script" XSS (Cross-Site Scripting) Web Application Zero Day Bug
Exploit Title: JCE-Tech "Video Niche Script" /view.php Multiple Parameters XSS
Product: "Video Niche Script"
Vendor: JCE-Tech
Vulnerable Versions: 4.0
Tested Version: 4.0
Advisory Publication: Nov 18, 2014
Latest Update: Nov 18, 2014
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-8752
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)
Advisory Details:
(1) Vendor & Product Description:
Vendor:
Product & Vulnerable Versions:
Video Niche Script
4.0
Vendor URL & Download:
Product can be obtained from here,
http://sourceforge.net/p/vufind/news/
Product Introduction Overview:
Vendor:
JCE-Tech
Product & Vulnerable Versions:
Video Niche Script
4.0
Vendor URL & Download:
Product can be obtained from here,
http://sourceforge.net/p/vufind/news/
Product Introduction Overview:
Product Description:
"The
PHP Video Script instantly creates a niche video site based on keywords
users control via the admin console. The videos are displayed on users'
site, but streamed from the YouTube servers."
(2) Vulnerability Details.
JCE-Tech "Video Niche Script" web
application has a computer security problem. Hackers can exploit it by
reflected XSS cyber attacks. This may allow a remote attacker to create a
specially crafted request that would execute arbitrary script code in a
user's browser session within the trust relationship between their
browser and the server.
Several other similar products 0-day vulnerabilities have been found by some other bug researchers before. JCE-Tech has patched some of them. "scip AG was founded in 2002. We are driven by innovation, sustainability, transparency, and enjoyment of our work. We are completely self-funded and are thus in the comfortable position to provide completely independent and neutral services. Our staff consists of highly specialized experts who focus on the topic information security and continuously further their expertise through advanced training".
Several other similar products 0-day vulnerabilities have been found by some other bug researchers before. JCE-Tech has patched some of them. "scip AG was founded in 2002. We are driven by innovation, sustainability, transparency, and enjoyment of our work. We are completely self-funded and are thus in the comfortable position to provide completely independent and neutral services. Our staff consists of highly specialized experts who focus on the topic information security and continuously further their expertise through advanced training".
(2.1) The code flaw occurs at "view.php" page with "video", "title" parameter.
No comments:
Post a Comment