CVE-2009-4237 Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8.5 allow remote attackers to inject arbitrary web script or HTML via (1) the req parameter to login.php, and allow remote auth...
LowCVSS 3.5
EPSS 3.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8.5 allow remote attackers to inject arbitrary web script or HTML via (1) the req parameter to login.php, and allow remote authenticated users to inject arbitrary web script or HTML via (2) the key parameter to lib/general/staticPage.php, (3) the tableName parameter to lib/attachments/attachmentupload.php, or the (4) startDate, (5) endDate, or (6) logLevel parameter to lib/events/eventviewer.php; (7) the search_notes_string parameter to lib/results/resultsMoreBuilds_buildReport.php; or the (8) expected_results, (9) name, (10) steps, or (11) summary parameter in a find action to lib/testcases/searchData.php, related to lib/functions/database.class.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| teamst testlink | <= 1.8.4 | No fix listed |
| teamst testlink | = 1.7 | No fix listed |
| teamst testlink | = 1.7.1 | No fix listed |
| teamst testlink | = 1.7.4 | No fix listed |
| teamst testlink | = 1.8-rc1 | No fix listed |
| teamst testlink | = 1.8.0 | No fix listed |
| teamst testlink | = 1.8.1 | No fix listed |
| teamst testlink | = 1.8.2 | No fix listed |
| teamst testlink | = 1.8.3 | No fix listed |
References
- 20091209 CORE-2009-1013: Multiple XSS and Injection Vulnerabilities in TestLink Test Management and Execution System mailing-list
- 60914 vdb-entry
- 60915 vdb-entry
- 60916 vdb-entry
- 60917 vdb-entry
- 60918 vdb-entry
- www.coresecurity.com exploit
- 37258 exploit patch vdb-entry
- www.teamst.org patch url-repurposed vendor-advisory