CVE-2009-4460 — MEDIUM (4.3)

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in Auto-Surf Traffic Exchange Script 1.1 allow remote attackers to inject arbitrary web script or HTML via the rid parameter to (1) index.php, (2) faq.php, and (3) register.php.

CVSS Score

4.3

MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Confidentiality

NONE

Integrity

PARTIAL

Availability

NONE

Affected Products

Vendor	Product	Versions
Ljscripts	Auto-Surf Traffic Exchange Script	1.1

Related Weaknesses (CWE)

CWE-79

References

http://osvdb.org/61285
http://osvdb.org/61286
http://osvdb.org/61287
http://secunia.com/advisories/37894Vendor Advisory
http://www.exploit-db.com/exploits/10616Exploit
http://osvdb.org/61285
http://osvdb.org/61286
http://osvdb.org/61287
http://secunia.com/advisories/37894Vendor Advisory
http://www.exploit-db.com/exploits/10616Exploit

FAQ

What is CVE-2009-4460?

CVE-2009-4460 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Multiple cross-site scripting (XSS) vulnerabilities in Auto-Surf Traffic Exchange Script 1.1 allow remote attackers to inject arbitrary web script or HTML via the rid parameter to (1) index.php, (2) f...

How severe is CVE-2009-4460?

CVE-2009-4460 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2009-4460?

Check the references section above for vendor advisories and patch information. Affected products include: Ljscripts Auto-Surf Traffic Exchange Script.