PT-2005-4488 · Phpmyfaq · Phpmyfaq

Tobias Klein · Publicado 2005-11-22 · Atualizado 2018-10-19 · CVE-2005-3734

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 1.5.3 and earlier

Description A cross-site scripting (XSS) issue exists in the "add content" page, allowing remote attackers to inject arbitrary web script or HTML via the thema, username, and usermail parameters.

Recommendations For phpMyFAQ versions 1.5.3 and earlier, as a temporary workaround, consider restricting access to the "add content" page until a patch is available. Avoid using the thema, username, and usermail parameters in the affected page until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-3734

Produtos afetados

Phpmyfaq

Referências · 10

• 🔥 http://trapkit.de/advisories/TKADV2005-11-004.txt · Exploit
• http://osvdb.org/20989 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3734 · Nota
• http://securityreason.com/securityalert/196 · Nota
• http://phpmyfaq.de/advisory_2005-11-18.php · Aviso do Fabricante
• http://vupen.com/english/advisories/2005/2505 · Nota
• http://securityfocus.com/bid/15504 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2005-3734 · Nota de Segurança
• http://securityfocus.com/archive/1/417219/30/0/threaded · Nota
• http://secunia.com/advisories/17649 · Aviso do Fabricante