A vulnerability was found in Fengoffice Feng Office up to 2.3. It has been rated as problematic. Affected by this issue is an unknown code. The manipulation of the argument ref_XXX with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows remote attackers to inject arbitrary web script or HTML via an arbitrary ref_XXX parameter.

The weakness was shared 10/28/2013 (Website). The advisory is shared for download at htbridge.com. This vulnerability is handled as CVE-2013-5744 since 09/16/2013. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1059.007.

The exploit is available at packetstormsecurity.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-58639, VDB-70664, VDB-131413 and VDB-268752 are related to this item.

Productinfo

Vendor

• Fengoffice

Name

• Feng Office

Version

• 2.0
• 2.1
• 2.2
• 2.3

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion