CVE-2009-2733

Description

Multiple cross-site scripting (XSS) vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the scheduler title in the scheduler module, and the (2) atksearch[contractnumber], (3) atksearch_AE_customer[customer], (4) atksearchmode[contracttype], and possibly (5) atksearch[contractname] parameters to the Organization Contracts administration page, reachable through dispatch.php.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/53745

https://exchange.xforce.ibmcloud.com/vulnerabilities/53744

http://www.securityfocus.com/archive/1/507133/100/0/threaded

http://www.bonsai-sec.com/blog/index.php/cross-site-scripting-payloads/

http://www.achievo.org/download/releasenotes/1_4_0

http://securitytracker.com/id?1023017

http://secunia.com/advisories/37035

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3