CVE-2017-6216

Name of the Vulnerable Software and Affected Versions novaksolutions/infusionsoft-php-sdk version v2016-10-31 novaksolutions/infusionsoft-php-sdk versions before v1.0

Description The issue is related to a reflected XSS in the leadscoring.php file, which can result in code execution. The ContactId parameter in the leadscoring.php file is vulnerable to this issue.

Recommendations For novaksolutions/infusionsoft-php-sdk version v2016-10-31, update to a version later than v2016-10-31. For novaksolutions/infusionsoft-php-sdk versions before v1.0, update to version v1.0 or later. As a temporary workaround, consider restricting access to the leadscoring.php file or avoiding the use of the ContactId parameter until a patch is available.