PT-2005-1703 · D-Forum · D-Forum

Publicado 2005-03-07 · Atualizado 2008-09-05 · CVE-2005-0660

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions D-Forum version 1.11

Description The issue allows remote attackers to inject arbitrary web script or HTML via certain fields. This can be demonstrated using the page parameter in "nav.php3".

Recommendations For D-Forum version 1.11, consider validating and sanitizing user input to prevent the injection of malicious scripts or HTML, especially for the page parameter in "nav.php3". As a temporary workaround, restrict access to the "nav.php3" page until a proper fix is applied.

Correção

Identificadores relacionados

CVE-2005-0660

Produtos afetados

D-Forum

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2005-0660 · Nota de Segurança
• http://secunia.com/advisories/14464 · Nota
• http://securitytracker.com/id?1013349 · Nota