CVE-2017-5990 Information

Description

An issue was discovered in PhreeBooksERP before 2017-02-13. The vulnerability exists due to insufficient filtration of user-supplied data in the \form\ HTTP GET parameter passed to the \PhreeBooksERP-master/extensions/ShippingMethods/ups/label_mgr/js_include.php\ and \PhreeBooksERP-master/extensions/ShippingMethods/yrc/label_mgr/js_include.php\ URLs. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. NOTE: these js_include.php files do not exist in the SourceForge \stable release\ (aka R37RC1).

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reference

http://www.securityfocus.com/bid/96219 https://github.com/phreebooks/PhreeBooksERP/commit/f2a32dede7cc7f9ff59fe983c5e4abe2966d837c https://github.com/phreebooks/PhreeBooksERP/issues/230

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

6.1