PT-2005-4748 · Php · Php Web Statistik

Ascii + 1 · Publicado 2005-12-05 · Atualizado 2017-07-20 · CVE-2005-4012

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP Web Statistik version 1.4

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities can be exploited via the lastnumber parameter to "stat.php" and the HTTP referer to "pixel.php".

Recommendations For PHP Web Statistik version 1.4, consider restricting access to the "stat.php" and "pixel.php" files until a patch is available. As a temporary workaround, avoid using the lastnumber parameter in the "stat.php" file. Additionally, restrict the HTTP referer to "pixel.php" to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-4012

Produtos afetados

Php Web Statistik

Referências · 11

• 🔥 http://ush.it/2005/11/19/php-web-statistik · Exploit
• http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00325.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-4012 · Nota de Segurança
• http://osvdb.org/21212 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23379 · Nota
• http://osvdb.org/21208 · Nota
• http://vupen.com/english/advisories/2005/2645 · Nota
• http://secunia.com/advisories/17789 · Aviso do Fabricante
• http://freewebstat.com/changelog-english.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23385 · Nota
• http://securityfocus.com/bid/15603 · Nota