PT-2006-4064 · Cs-Forum · Cs-Forum

Darkfig · Publicado 2006-06-23 · Atualizado 2018-10-18 · CVE-2006-3169

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CS-Forum versions 0.81 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters in two scripts:

• In "read.php", the msg result and rep titre parameters are vulnerable.
• In "ajouter.php", the id and parent parameters, as well as the CSForum nom, CSForum mail, and CSForum url cookie parameters, are vulnerable.

Recommendations For CS-Forum versions 0.81 and earlier, as a temporary workaround, consider restricting access to the "read.php" and "ajouter.php" scripts until a patch is available. Avoid using the vulnerable parameters msg result, rep titre, id, parent, CSForum nom, CSForum mail, and CSForum url in the affected scripts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-3169

Produtos afetados

Cs-Forum

Referências · 10

• http://vupen.com/english/advisories/2006/2314 · Nota
• http://securityfocus.com/archive/1/436789/100/0/threaded · Nota
• http://comscripts.com/scripts/php.cs-forum.643.html · Nota
• http://secunia.com/advisories/20534 · Aviso do Fabricante
• http://osvdb.org/26380 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27175 · Nota
• http://acid-root.new.fr/advisories/csforum081.txt · Aviso do Fabricante
• http://securityreason.com/securityalert/1124 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3169 · Nota de Segurança
• http://osvdb.org/26379 · Nota