白帽子安全

白帽子文章
计算机安全
安全漏洞
网络攻击

© 白帽子安全 | Powered by LOFTER

CVE-2014-8752 JCE-Tech "Video Niche Script" XSS (C

CVE-2014-8752 JCE-Tech "Video Niche Script" XSS (Cross-Site Scripting) Security Vulnerability



Exploit Title: JCE-Tech "Video Niche Script" /view.php Multiple Parameters XSS

Product: "Video Niche Script"

Vendor: JCE-Tech

Vulnerable Versions: 4.0

Tested Version: 4.0

Advisory Publication: Nov 18, 2014

Latest Update: Nov 18, 2014

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-8752

CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6 

Credit: Wang Jing [CCRG, Nanyang Technological University, Singapore]







Advisory Details:


(1) Vendor URL:

http://jce-tech.com/products/


Product Description:

"The PHP Video Script instantly creates a niche video site based on keywords users control via the admin console. The videos are displayed on users' site, but streamed from the YouTube servers."





(2) Vulnerability Details.


JCE-Tech "Video Niche Script" has a security problem. It is vulnerable to XSS attacks.



(2.1) The vulnerability occurs at "view.php" page with "video", "title" parameter.










References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8752

http://tetraph.com/security/cves/cve-2014-8752-jce-tech-video-niche-script-xss-cross-site-scripting-security-vulnerability/

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8752

http://seclists.org/fulldisclosure/2014/Dec/84

http://www.securityfocus.com/bid/71738

http://www.intelligentexploit.com/view-details.html?id=20454

http://packetstormsecurity.com/files/129661/JCE-Tech-4.0-Cross-Site-Scripting.html

http://itinfotech.tumblr.com/

http://en.hackdig.com/?11701.htm

http://www.inzeed.com/kaleidoscope/xss-vulnerability/cve-2014-8752-jce-tech-video-niche-script-xss-cross-site-scripting-security-vulnerability/

http://ittechnology.lofter.com/

http://user.qzone.qq.com/2519094351/2

https://tetraph.wordpress.com/2015/02/10/cve-2014-8752-jce-tech-video-niche-script-xss-cross-site-scripting-security-vulnerability/






评论