PT-2002-2671 · Phprank · Phprank

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-1950

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpRank version 1.8

Description The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerability can be exploited through the email parameter of "add.php" or the banurl parameter, which is the banner URL in the main list.

Recommendations For phpRank version 1.8, as a temporary workaround, consider validating and sanitizing user input for the email parameter in "add.php" and the banurl parameter to prevent malicious script injections. Restrict access to "add.php" and limit the ability to set the banner URL to trusted users until a fix is available.

Exploit

Correção

Identificadores relacionados

CVE-2002-1950

Produtos afetados

Phprank

Referências · 4

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-10/0148.html · Exploit
• http://iss.net/security_center/static/10351.php · Nota
• http://securityfocus.com/bid/5946 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1950 · Nota de Segurança