PT-2004-1476 · Xmb Forum · Xmb

Janek Vind + 1 · Publicado 2004-02-23 · Atualizado 2021-04-29 · CVE-2004-0322

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions XMB version 1.8 Final SP2

Description The issue allows remote attackers to execute arbitrary script as other users. This can be achieved through various means, including the member parameter in "member.php", the uid parameter in "u2uadmin.php", the user parameter in "editprofile.php", an onmouseover event in an align tag when bbcode is allowed, or an img tag where bbcode is allowed.

Recommendations For XMB version 1.8 Final SP2, consider disabling the execution of scripts in the mentioned parameters and tags until a patch is available. Restrict access to the "member.php", "u2uadmin.php", and "editprofile.php" files to minimize the risk of exploitation. Avoid using the member, uid, and user parameters in the affected files, and disable the use of onmouseover events in align tags and img tags when bbcode is allowed.

Exploit

Correção

Identificadores relacionados

CVE-2004-0322

Produtos afetados

Xmb

Referências · 11

• 🔥 https://exploit-db.com/exploits/23746 · Exploit
• 🔥 https://exploit-db.com/exploits/23745 · Exploit
• 🔥 https://exploit-db.com/exploits/23747 · Exploit
• 🔥 http://securityfocus.com/bid/9726 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15294 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0322 · Nota de Segurança
• http://xmbforum.com/community/boards/viewthread.php?tid=746859 · Nota
• https://docs.xmbforum2.com/index.php?title=Security_Issue_History · Nota
• http://marc.info/?l=bugtraq&m=107756526625179&w=2 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2004-02/0645.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15292 · Nota