PT-2005-3763 · Cj · Cjweb2Mail

Psymera · Publicado 2005-09-14 · Atualizado 2016-10-18 · CVE-2005-2901

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CjWeb2Mail version 3.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters, including the name, message, or ip parameter to 'thankyou.php' or the emsg parameter to 'web2mail.php'.

Recommendations For CjWeb2Mail version 3.0, consider validating and sanitizing user input for the name, message, ip, and emsg parameters to prevent arbitrary web script or HTML injection. As a temporary workaround, restrict access to 'thankyou.php' and 'web2mail.php' to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-2901

Produtos afetados

Cjweb2Mail

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2005-2901 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=112629507412619&w=2 · Nota