PT-2006-2439 · Fusionzone · Fusionzone Couponzone

Publicado 2006-03-28 · Atualizado 2017-07-20 · CVE-2006-1431

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions fusionZONE couponZONE version 4.2

Description The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via URL-encoded parameters, specifically the srchfor and srchby parameters.

Recommendations For fusionZONE couponZONE version 4.2, update the local.cfm file to properly encode and validate user input for the srchfor and srchby parameters to prevent XSS attacks. As a temporary workaround, consider restricting access to the local.cfm file until a patch is available. Avoid using the srchfor and srchby parameters in the affected URL until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-1431

Produtos afetados

Fusionzone Couponzone

Referências · 8

• 🔥 http://securityfocus.com/bid/17272 · Exploit
• 🔥 https://exploit-db.com/exploits/27489 · Exploit
• http://vupen.com/english/advisories/2006/1127 · Nota
• http://osvdb.org/24180 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25484 · Nota
• http://pridels0.blogspot.com/2006/03/couponzone-v42-multiple-vuln.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1431 · Nota de Segurança
• http://secunia.com/advisories/19430 · Aviso do Fabricante