Endonesia · Endonesia · CVE-2006-6871
Name of the Vulnerable Software and Affected Versions:
eNdonesia version 8.4
Description:
The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various means, including the `mod` parameter in a `viewlink` operation in `mod.php`, the `intypeid` parameter in a `showinfo` operation in the `informasi` module in `mod.php`, the "your Friend" field in `friend.php`, or the "Main Text" field in `admin.php`.
Recommendations:
For eNdonesia version 8.4, consider disabling the vulnerable fields and parameters, such as the `mod` parameter in `mod.php`, the `intypeid` parameter in the `informasi` module, the "your Friend" field in `friend.php`, and the "Main Text" field in `admin.php`, until a patch is available. Restrict access to the affected modules and files to minimize the risk of exploitation.