PT-2005-5221 · Simpbook · Simpbook

0O_Zeus_O0 · Publicado 2005-12-28 · Atualizado 2016-10-18 · CVE-2005-4551

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SimpBook version 1.0

Description A cross-site scripting (XSS) issue exists due to the failure to properly sanitize user input. When the html enable option is enabled, remote attackers can inject arbitrary web script or HTML via the message parameter to "index.php". This allows for the execution of malicious code on the victim's browser.

Recommendations For SimpBook version 1.0, as a temporary workaround, consider disabling the html enable option until a patch is available. Restrict access to the "index.php" endpoint to minimize the risk of exploitation. Avoid using the message parameter in the affected endpoint until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-4551

Produtos afetados

Simpbook

Referências · 5

• http://marc.info/?l=full-disclosure&m=113535570125766&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4551 · Nota de Segurança
• http://secunia.com/advisories/18256 · Aviso do Fabricante
• http://securityfocus.com/bid/16058 · Nota
• http://securityfocus.com/bid/16053 · Nota