« Volver al listado

CVE-2009-2302

Estado: ModificadaMedia (4.3)—

Cross-site scripting (XSS) vulnerability in index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action. NOTE: it was later reported that 5.2.1 is also affected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Avatic — Aardvark Topsites PHP

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-2302",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-07-02T10:30:00.467",
  "references": [
    {
      "url": "http://secunia.com/advisories/41985",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://websec.id3as.com/aardvark-topsites-php-521-security-vulnerabilities-disclosure/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/504574/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/514423/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/35506",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51391",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/41985",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://websec.id3as.com/aardvark-topsites-php-521-security-vulnerabilities-disclosure/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/504574/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/514423/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/35506",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51391",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action. NOTE: it was later reported that 5.2.1 is also affected."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en el archivo index.php en Topsites PHP de Aardvark versiones 5.2.0 y anteriores, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro q en una acción search. NOTA: más tarde se informó que la versión 5.2.1 también está afectada."
    }
  ],
  "lastModified": "2026-06-16T23:09:10.397",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:avatic:aardvark_topsites_php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB296624-CB68-4E12-8560-59C56542A422",
              "versionEndIncluding": "5.2.0"
            },
            {
              "criteria": "cpe:2.3:a:avatic:aardvark_topsites_php:4.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02BB4B5A-0D58-4696-AF23-8B8A5295FAF7"
            },
            {
              "criteria": "cpe:2.3:a:avatic:aardvark_topsites_php:4.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5CA47010-FD73-4897-A580-4AAE589FE904"
            },
            {
              "criteria": "cpe:2.3:a:avatic:aardvark_topsites_php:4.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DD9D097-C3E0-4CB3-A802-15D1F807B0B0"
            },
            {
              "criteria": "cpe:2.3:a:avatic:aardvark_topsites_php:5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01F8A0E7-7087-46AF-B2EB-29CDA8FD0CE7"
            },
            {
              "criteria": "cpe:2.3:a:avatic:aardvark_topsites_php:5.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "969B3A92-77E2-4CD5-AA50-604CF12DB668"
            },
            {
              "criteria": "cpe:2.3:a:avatic:aardvark_topsites_php:5.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C282DA40-217E-4FA1-825E-6EE380F20940"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}