Medium severity6.1NVD Advisory· Published Feb 15, 2017· Updated May 13, 2026
CVE-2017-5990
CVE-2017-5990
Description
An issue was discovered in PhreeBooksERP before 2017-02-13. The vulnerability exists due to insufficient filtration of user-supplied data in the "form" HTTP GET parameter passed to the "PhreeBooksERP-master/extensions/ShippingMethods/ups/label_mgr/js_include.php" and "PhreeBooksERP-master/extensions/ShippingMethods/yrc/label_mgr/js_include.php" URLs. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. NOTE: these js_include.php files do not exist in the SourceForge "stable release" (aka R37RC1).
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/phreebooks/PhreeBooksERP/commit/f2a32dede7cc7f9ff59fe983c5e4abe2966d837cnvdPatch
- github.com/phreebooks/PhreeBooksERP/issues/230nvdExploitPatchVendor Advisory
- www.securityfocus.com/bid/96219nvdThird Party AdvisoryVDB Entry
News mentions
0No linked articles in our index yet.