PT-2005-1580 · Pblang · Pblang

Raven · Publicado 2005-02-23 · Atualizado 2016-10-18 · CVE-2005-0526

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PBLang version 4.65

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various means, including the search string to the "search.php" endpoint, the subject of a private message processed by "pm.php", or the body of a private message processed by "pmpshow.php".

Recommendations For PBLang version 4.65, consider disabling the search functionality in "search.php", restricting user input in the subject and body of private messages processed by "pm.php" and "pmpshow.php" respectively, until a fix is available.

Correção

Identificadores relacionados

CVE-2005-0526

Produtos afetados

Pblang

Referências · 5

• http://marc.info/?l=bugtraq&m=110917702708589&w=2 · Nota
• http://marc.info/?l=bugtraq&m=110917768511595&w=2 · Nota
• http://securitytracker.com/id?1013277 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0526 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=110917641105486&w=2 · Nota