CVE-2017-2171 Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to...
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF & Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bestwebsoft captcha | <= 4.2.9 | No fix listed |
| bestwebsoft car rental | <= 1.0.4 | No fix listed |
| bestwebsoft contact form | <= 4.0.5 | No fix listed |
| bestwebsoft contact form multi | <= 1.2.0 | No fix listed |
| bestwebsoft contact form to db | <= 1.5.6 | No fix listed |
| bestwebsoft custom admin page | <= 0.1.1 | No fix listed |
| bestwebsoft custom fields search | <= 1.3.1 | No fix listed |
| bestwebsoft custom search | <= 1.35 | No fix listed |
| bestwebsoft donate | <= 2.1.0 | No fix listed |
| bestwebsoft email queue | <= 1.1.1 | No fix listed |
| bestwebsoft error log viewer | <= 1.0.5 | No fix listed |
| bestwebsoft facebook button | <= 2.53 | No fix listed |
| bestwebsoft featured posts | <= 1.0.0 | No fix listed |
| bestwebsoft Gallery | <= 4.4.9 | No fix listed |
| bestwebsoft gallery categories | <= 1.0.8 | No fix listed |
| bestwebsoft google +1 | <= 1.3.3 | No fix listed |
| bestwebsoft google adsense | <= 1.43 | No fix listed |
| bestwebsoft google analytics | <= 1.7.0 | No fix listed |
| bestwebsoft google captcha recaptcha | <= 1.27 | No fix listed |
| bestwebsoft google maps | <= 1.3.5 | No fix listed |
| bestwebsoft google shortlink | <= 1.5.2 | No fix listed |
| bestwebsoft google sitemap | <= 3.0.7 | No fix listed |
| bestwebsoft htaccess | <= 1.7.5 | No fix listed |
| bestwebsoft job board | <= 1.1.2 | No fix listed |
| bestwebsoft latest posts | <= 0.2 | No fix listed |
Show 77 more
| Product | Affected versions | Fixed in |
|---|---|---|
| bestwebsoft limit attempts | <= 1.1.7 | No fix listed |
| bestwebsoft linkedin | <= 1.0.4 | No fix listed |
| bestwebsoft multilanguage | <= 1.2.1 | No fix listed |
| bestwebsoft pagination | <= 1.0.6 | No fix listed |
| bestwebsoft pdf print | <= 1.9.3 | No fix listed |
| bestwebsoft pinterest | <= 1.0.4 | No fix listed |
| bestwebsoft popular posts | <= 1.0.4 | No fix listed |
| bestwebsoft portfolio | <= 2.3 | No fix listed |
| bestwebsoft post to csv | <= 1.3.0 | No fix listed |
| bestwebsoft profile extra | <= 1.0.6 | No fix listed |
| bestwebsoft promobar | <= 1.1.0 | No fix listed |
| bestwebsoft quotes and tips | <= 1.31 | No fix listed |
| bestwebsoft re-attacher | <= 1.0.8 | No fix listed |
| bestwebsoft realty | <= 1.0.9 | No fix listed |
| bestwebsoft relevant - related posts | <= 1.1.9 | No fix listed |
| bestwebsoft sender | <= 1.2.0 | No fix listed |
| bestwebsoft smtp | <= 1.0.9 | No fix listed |
| bestwebsoft social buttons pack | <= 1.1.0 | No fix listed |
| bestwebsoft subscriber | <= 1.3.4 | No fix listed |
| bestwebsoft testimonials | <= 0.1.8 | No fix listed |
| bestwebsoft timesheet | <= 0.1.4 | No fix listed |
| bestwebsoft twitter button | <= 2.54 | No fix listed |
| bestwebsoft updater | <= 1.34 | No fix listed |
| bestwebsoft user role | <= 1.5.5 | No fix listed |
| bestwebsoft visitors online | <= 0.9 | No fix listed |
| bestwebsoft zendesk help center | <= 1.0.4 | No fix listed |
| bestwebsoft captcha | = prior to version 4.3.0 | No fix listed |
| bestwebsoft car rental | = prior to version 1.0.5 | No fix listed |
| bestwebsoft contact form multi | = prior to version 1.2.1 | No fix listed |
| bestwebsoft contact form | = prior to version 4.0.6 | No fix listed |
| bestwebsoft contact form to db | = prior to version 1.5.7 | No fix listed |
| bestwebsoft custom admin page | = prior to version 0.1.2 | No fix listed |
| bestwebsoft custom fields search | = prior to version 1.3.2 | No fix listed |
| bestwebsoft custom search | = prior to version 1.36 | No fix listed |
| bestwebsoft donate | = prior to version 2.1.1 | No fix listed |
| bestwebsoft email queue | = prior to version 1.1.2 | No fix listed |
| bestwebsoft error log viewer | = prior to version 1.0.6 | No fix listed |
| bestwebsoft facebook button | = prior to version 2.54 | No fix listed |
| bestwebsoft featured posts | = prior to version 1.0.1 | No fix listed |
| bestwebsoft gallery categories | = prior to version 1.0.9 | No fix listed |
| bestwebsoft Gallery | = prior to version 4.5.0 | No fix listed |
| bestwebsoft google +1 | = prior to version 1.3.4 | No fix listed |
| bestwebsoft google adsense | = prior to version 1.44 | No fix listed |
| bestwebsoft google analytics | = prior to version 1.7.1 | No fix listed |
| bestwebsoft google captcha recaptcha | = prior to version 1.28 | No fix listed |
| bestwebsoft google maps | = prior to version 1.3.6 | No fix listed |
| bestwebsoft google shortlink | = prior to version 1.5.3 | No fix listed |
| bestwebsoft google sitemap | = prior to version 3.0.8 | No fix listed |
| bestwebsoft htaccess | = prior to version 1.7.6 | No fix listed |
| bestwebsoft job board | = prior to version 1.1.3 | No fix listed |
| bestwebsoft latest posts | = prior to version 0.3 | No fix listed |
| bestwebsoft limit attempts | = prior to version 1.1.8 | No fix listed |
| bestwebsoft linkedin | = prior to version 1.0.5 | No fix listed |
| bestwebsoft multilanguage | = prior to version 1.2.2 | No fix listed |
| bestwebsoft pdf print | = prior to version 1.9.4 | No fix listed |
| bestwebsoft pagination | = prior to version 1.0.7 | No fix listed |
| bestwebsoft pinterest | = prior to version 1.0.5 | No fix listed |
| bestwebsoft popular posts | = prior to version 1.0.5 | No fix listed |
| bestwebsoft portfolio | = prior to version 2.4 | No fix listed |
| bestwebsoft post to csv | = prior to version 1.3.1 | No fix listed |
| bestwebsoft profile extra | = prior to version 1.0.7 | No fix listed |
| bestwebsoft promobar | = prior to version 1.1.1 | No fix listed |
| bestwebsoft quotes and tips | = prior to version 1.32 | No fix listed |
| bestwebsoft re-attacher | = prior to version 1.0.9 | No fix listed |
| bestwebsoft realty | = prior to version 1.1.0 | No fix listed |
| bestwebsoft relevant - related posts | = prior to version 1.2.0 | No fix listed |
| bestwebsoft sender | = prior to version 1.2.1 | No fix listed |
| bestwebsoft smtp | = prior to version 1.1.0 | No fix listed |
| bestwebsoft social buttons pack | = prior to version 1.1.1 | No fix listed |
| bestwebsoft subscriber | = prior to version 1.3.5 | No fix listed |
| bestwebsoft testimonials | = prior to version 0.1.9 | No fix listed |
| bestwebsoft timesheet | = prior to version 0.1.5 | No fix listed |
| bestwebsoft twitter button | = prior to version 2.55 | No fix listed |
| bestwebsoft user role | = prior to version 1.5.6 | No fix listed |
| bestwebsoft updater | = prior to version 1.35 | No fix listed |
| bestwebsoft visitors online | = prior to version 1.0.0 | No fix listed |
| bestwebsoft zendesk help center | = prior to version 1.0.5 | No fix listed |
References
- JVNDB-2017-000094 third-party-advisory vdb-entry
- JVN#24834813 third-party-advisory vdb-entry