Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-3581 | First vendor Publication | 2009-12-23 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:S/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 3.5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 6.8 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple cross-site scripting (XSS) vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via (1) the DCN Description field in the Accounts Receivables menu item for Add Transaction, (2) the Description field in the Accounts Payable menu item for Add Transaction, or the name field in (3) the Customers menu item for Add Customer or (4) the Vendor menu item for Add Vendor. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3581 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-12-31 | Name : SQL-Ledger Multiple Vulnerabilities File : nvt/secpod_sql_ledger_mult_vuln.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 61330 | SQL-Ledger Add Vendor Vendor Parameter XSS SQL-Ledger contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'Vendor' parameter upon submission to the 'Add Vendor' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. |
| 61329 | SQL-Ledger Add Customer Customers Parameter XSS SQL-Ledger contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'Customers' parameter upon submission to the 'Add Customer' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. |
| 61328 | SQL-Ledger Add Transaction Multiple Parameter XSS |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:09:40 |
|
| 2024-11-28 12:19:58 |
|
| 2021-05-04 12:10:18 |
|
| 2021-04-22 01:10:43 |
|
| 2020-05-23 00:24:25 |
|
| 2018-10-11 00:19:42 |
|
| 2017-08-17 09:22:44 |
|
| 2016-04-26 19:11:14 |
|
| 2013-05-10 23:59:05 |
|
