PT-2004-2471 · W Agora · W-Agora

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-1563

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions w-Agora version 4.1.6a

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary web script or HTML. The affected API endpoints include "download thread.php", "login.php", and "forgot password.php". Specifically, the thread parameter to "download thread.php", the loginuser parameter to "login.php", and the userid parameter to "forgot password.php" are vulnerable.

Recommendations For w-Agora version 4.1.6a, consider disabling the execution of web scripts or HTML in the affected parameters as a temporary workaround. Restrict access to the vulnerable endpoints "download thread.php", "login.php", and "forgot password.php" to minimize the risk of exploitation. Avoid using the thread, loginuser, and userid parameters in the respective endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2004-1563

Produtos afetados

W-Agora

Referências · 11

• 🔥 https://exploit-db.com/exploits/24652 · Exploit
• 🔥 http://securityfocus.com/bid/11283 · Exploit
• 🔥 https://exploit-db.com/exploits/24649 · Exploit
• 🔥 https://exploit-db.com/exploits/24650 · Exploit
• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/027040.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1563 · Nota
• http://securitytracker.com/id?1011463 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1563 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17553 · Nota
• http://marc.info/?l=bugtraq&m=109655691512298&w=2 · Nota
• http://secunia.com/advisories/12695 · Aviso do Fabricante