PT-2006-2659 · Unknown · Arab Portal

Publicado 2006-04-07 · Atualizado 2018-10-18 · CVE-2006-1665

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Arab Portal version 2.0.1

Description: The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in various PHP files. This is achieved through the adminJump and forum middle parameters in forum.php, and the form parameter in members.php, pm.php, and mail.php.

Recommendations: For Arab Portal version 2.0.1, consider restricting access to the adminJump and forum middle parameters in forum.php, and the form parameter in members.php, pm.php, and mail.php to minimize the risk of exploitation. As a temporary workaround, avoid using these parameters in the affected API endpoints until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-1665

Produtos afetados

Arab Portal

Referências · 5

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1665 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1665 · Nota de Segurança
• http://securityfocus.com/bid/17375 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25657 · Nota
• http://securityfocus.com/archive/1/429940/100/0/threaded · Nota