Vulnerability Details : CVE-2009-2156
Multiple cross-site scripting (XSS) vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Title field to requests.php, related to viewrequests.php; and (2) the Torrent Name field to torrents-upload.php, related to the logging of torrent uploads; and allow remote attackers to inject arbitrary web script or HTML via (3) the ttversion parameter to themes/default/footer.php, the (4) SITENAME and (5) CURUSER[username] parameters to themes/default/header.php, (6) the todayactive parameter to visitorstoday.php, (7) the activepeople parameter to visitorsnow.php, (8) the faq_categ[999][title] parameter to faq.php, and (9) the keepget parameter to torrents-details.php.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2009-2156
Probability of exploitation activity in the next 30 days: 0.15%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 51 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2009-2156
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
3.5
|
LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |
6.8
|
2.9
|
NIST |
CWE ids for CVE-2009-2156
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-2156
- http://www.securityfocus.com/archive/1/504294/100/0/threaded
-
http://www.securityfocus.com/bid/35369
Exploit
-
https://www.exploit-db.com/exploits/8958
TorrentTrader Classic 1.09 - Multiple Vulnerabilities - PHP webapps Exploit
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/51145
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/51144
-
http://www.waraxe.us/advisory-74.html
[waraxe-2009-SA#074] - Multiple Vulnerabilities in TorrentTrader Classic 1.09Exploit
Products affected by CVE-2009-2156
- cpe:2.3:a:torrenttrader:torrenttrader_classic:1.09:*:*:*:*:*:*:*