PT-2005-4341 · Php · Phpkit

Publicado 2005-11-16 · Atualizado 2017-07-11 · CVE-2005-3552

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHPKIT versions 1.6.1 R2 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple vectors, including the login/profile.php, login/userinfo.php, admin/admin.php, imcenter.php, referer statistics, HTML title element, logo alt attributes in forum postings, and the Homepage field in the Guestbook.

Recommendations For PHPKIT versions 1.6.1 R2 and earlier, update to a version later than 1.6.1 R2 to resolve the issue. As a temporary workaround, consider restricting access to the affected files, such as login/profile.php, login/userinfo.php, admin/admin.php, and imcenter.php, until a patch is available. Avoid using the vulnerable fields, such as the Homepage field in the Guestbook, and the logo alt attributes in forum postings, until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2005-3552

Produtos afetados

Phpkit

Referências · 21

• http://secunia.com/advisories/17479 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23003 · Nota
• http://hardened-php.net/advisory_212005.80.html · Aviso do Fabricante
• http://osvdb.org/20554 · Nota
• http://osvdb.org/20558 · Nota
• http://securitytracker.com/id?1015167 · Nota
• http://securityfocus.com/bid/15354 · Nota
• http://osvdb.org/20553 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23007 · Nota
• http://osvdb.org/20557 · Nota
• http://osvdb.org/20555 · Nota
• http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00110.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23006 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3552 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23009 · Nota