PT-2006-4173 · Aedating · Aedating

Publicado 2006-06-28 · Atualizado 2018-10-18 · CVE-2006-3279

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions aeDating version 4.1

Description The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via specific parameters in certain PHP files. The vulnerable parameters include the Sex parameter in "index.php", the ProfileType parameter in "join form.php", and the Email parameter in "forgot.php".

Recommendations For aeDating version 4.1, consider validating and sanitizing user input for the Sex, ProfileType, and Email parameters to prevent XSS attacks. As a temporary workaround, restrict access to the affected PHP files until a patch is available.

Correção

Identificadores relacionados

CVE-2006-3279

Produtos afetados

Aedating

Referências · 8

• http://osvdb.org/26830 · Nota
• http://securityfocus.com/archive/1/438157/100/0/threaded · Nota
• http://vupen.com/english/advisories/2006/2533 · Nota
• http://secunia.com/advisories/20820 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-3279 · Nota de Segurança
• http://osvdb.org/26832 · Nota
• http://osvdb.org/26831 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27339 · Nota