CVE-2018-5705 Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine (the t parameter to the /search URI). Since there is an user/admin login interface, it's possible for...
MediumCVSS 6.1
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine (the t parameter to the /search URI). Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admin(s). By sending users an infected URL, code will be executed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| reservo image hosting | = 1.6 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 43676 exploit third-party-advisory vdb-entry