CVE-2010-3266
published 2010-12-02CVE-2010-3266: Multiple cross-site scripting (XSS) vulnerabilities in BugTracker.NET before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via…
PriorityP415low3.5CVSS 2.0
AVNACMAuSCNIPAN
EXPLOIT
EPSS
2.80%
84.7th percentile
Multiple cross-site scripting (XSS) vulnerabilities in BugTracker.NET before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via (1) the pcd parameter to edit_bug.aspx, (2) the bug_id parameter to edit_comment.aspx, (3) the id parameter to edit_user_permissions2.aspx, or (4) the default_name parameter to edit_customfield.aspx. NOTE: some of these details are obtained from third party information.
Affected
85 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ifdefined | bugtracker.net | <= 3.4.4 | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
| ifdefined | bugtracker.net | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
BugTracker.NET 3.4.4 - Multiple Vulnerabilities
exploitdb·2010-12-01·CVSS 3.5
CVE-2010-3267 [LOW] BugTracker.NET 3.4.4 - Multiple Vulnerabilities
BugTracker.NET 3.4.4 - Multiple Vulnerabilities
---
Core Security Technologies - CoreLabs Advisory
http://corelabs.coresecurity.com/
Multiple vulnerabilities in BugTracker.Net
1. *Advisory Information*
Title: Multiple vulnerabilities in BugTracker.Net
Advisory Id: CORE-2010-1109
Advisory URL:
[http://www.coresecurity.com/content/multiple-vulnerabilities-in-bugtracker]
Date published: 2010-11-30
Date of last update: 2010-11-30
Vendors contacted: BugTracker.NET team
Release mode: Coordinated release
2. *Vulnerability Information*
Class: Cross site scripting [CWE-79], SQL injection [CWE-89]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2010-3266, CVE-2010-3267
Bugtraq ID: N/A
3. *Vulnerability Description*
BugTracker.NET [1][2] is an open-s
Exploit-DB
BugTracker.NET 3.4.4 - SQL Injection / Cross-Site Scripting
exploitdb·2010-11-30
CVE-2010-3266 BugTracker.NET 3.4.4 - SQL Injection / Cross-Site Scripting
BugTracker.NET 3.4.4 - SQL Injection / Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/45121/info
BugTracker.NET is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
BugTracker.NET v3.4.4 is vulnerable; other versions may be affected.
http://www.example.com/edit_comment.aspx?id=48&bug_id=3%3E%3Cscript%3Ealert%28%27%27%29;%3C/script%3E
No writeups or analysis indexed.
http://btnet.svn.sourceforge.net/viewvc/btnet/RELEASE_NOTES.TXT?revision=578&view=markuphttp://secunia.com/advisories/42418http://www.coresecurity.com/content/multiple-vulnerabilities-in-bugtrackerhttp://www.exploit-db.com/exploits/15653http://www.securityfocus.com/archive/1/514957/100/0/threadedhttp://www.securityfocus.com/bid/45121http://btnet.svn.sourceforge.net/viewvc/btnet/RELEASE_NOTES.TXT?revision=578&view=markuphttp://secunia.com/advisories/42418http://www.coresecurity.com/content/multiple-vulnerabilities-in-bugtrackerhttp://www.exploit-db.com/exploits/15653http://www.securityfocus.com/archive/1/514957/100/0/threadedhttp://www.securityfocus.com/bid/45121
2010-12-02
Published