CVE-2017-5990

NONE EPSS 59.0%
Published Feb 15, 20179y ago · Modified Jun 17, 20262w ago
Find Similar
Published Feb 15, 2017 9y ago
Last Modified Jun 17, 2026 2w ago

Description

An issue was discovered in PhreeBooksERP before 2017-02-13. The vulnerability exists due to insufficient filtration of user-supplied data in the "form" HTTP GET parameter passed to the "PhreeBooksERP-master/extensions/ShippingMethods/ups/label_mgr/js_include.php" and "PhreeBooksERP-master/extensions/ShippingMethods/yrc/label_mgr/js_include.php" URLs. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. NOTE: these js_include.php files do not exist in the SourceForge "stable release" (aka R37RC1).

Threat Intelligence

EPSS Exploit Probability
59.0% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
phreesoftphreebookserp* ≤2016-01-23

References 3

  • securityfocus.com http://www.securityfocus.com/bid/96219
    Third Party AdvisoryVDB Entry
  • github.com https://github.com/phreebooks/PhreeBooksERP/commit/f2a32dede7cc7f9ff59fe983c5e4abe2966d837c
    Patch
  • github.com https://github.com/phreebooks/PhreeBooksERP/issues/230
    ExploitPatchVendor Advisory

Remediation

  • github.com https://github.com/phreebooks/PhreeBooksERP/commit/f2a32dede7cc7f9ff59fe983c5e4abe2966d837c
    Patch
  • github.com https://github.com/phreebooks/PhreeBooksERP/issues/230
    ExploitPatchVendor Advisory