Vulnerability Description
An issue was discovered in PhreeBooksERP before 2017-02-13. The vulnerability exists due to insufficient filtration of user-supplied data in the "form" HTTP GET parameter passed to the "PhreeBooksERP-master/extensions/ShippingMethods/ups/label_mgr/js_include.php" and "PhreeBooksERP-master/extensions/ShippingMethods/yrc/label_mgr/js_include.php" URLs. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. NOTE: these js_include.php files do not exist in the SourceForge "stable release" (aka R37RC1).
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phreesoft | Phreebookserp | <= 2016-01-23 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/96219Third Party AdvisoryVDB Entry
- https://github.com/phreebooks/PhreeBooksERP/commit/f2a32dede7cc7f9ff59fe983c5e4aPatch
- https://github.com/phreebooks/PhreeBooksERP/issues/230ExploitPatchVendor Advisory
- http://www.securityfocus.com/bid/96219Third Party AdvisoryVDB Entry
- https://github.com/phreebooks/PhreeBooksERP/commit/f2a32dede7cc7f9ff59fe983c5e4aPatch
- https://github.com/phreebooks/PhreeBooksERP/issues/230ExploitPatchVendor Advisory
FAQ
What is CVE-2017-5990?
CVE-2017-5990 is a vulnerability with a CVSS score of 6.1 (MEDIUM). An issue was discovered in PhreeBooksERP before 2017-02-13. The vulnerability exists due to insufficient filtration of user-supplied data in the "form" HTTP GET parameter passed to the "PhreeBooksERP-...
How severe is CVE-2017-5990?
CVE-2017-5990 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-5990?
Check the references section above for vendor advisories and patch information. Affected products include: Phreesoft Phreebookserp.