PT-2006-3491 · Xtreme · Xtreme Topsites

Luny · Publicado 2006-05-23 · Atualizado 2018-10-18 · CVE-2006-2545

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Xtreme Topsites version 1.1

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially resulting from SQL injection. This is achieved via the id parameter in "stats.php" and unspecified inputs in "lostid.php", likely including the searchthis parameter.

Recommendations For Xtreme Topsites version 1.1, avoid using the id parameter in "stats.php" and the searchthis parameter in "lostid.php" until a fix is available. As a temporary workaround, consider restricting access to "stats.php" and "lostid.php" to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2006-2545

Produtos afetados

Xtreme Topsites

Referências · 8

• http://securityreason.com/securityalert/945 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2545 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26614 · Nota
• http://osvdb.org/25702 · Nota
• http://secunia.com/advisories/20192 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/1899 · Aviso do Fabricante
• http://securityfocus.com/archive/1/434568/100/0/threaded · Nota
• http://securityfocus.com/bid/18055 · Nota