CVE-2011-5042 Cross-site scripting (XSS) vulnerability in inc/lib/lib.base.php in SASHA 0.2.0 allows remote attackers to inject arbitrary web script or HTML via the instructors parameter. NOTE: the original disclos...
MediumCVSS 4.3
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in inc/lib/lib.base.php in SASHA 0.2.0 allows remote attackers to inject arbitrary web script or HTML via the instructors parameter. NOTE: the original disclosure also mentions the section_title parameter, but this was disputed by the vendor and retracted by the original researcher.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gphemsley sasha | = 0.2.0 | No fix listed |
References
- 20111218 SASHA v0.2.0 Mutiple XSS mailing-list
- sasha.svn.sourceforge.net
- sourceforge.net
- sasha-multiple-xss(71874) vdb-entry