PT-2006-4205 · Qatraq · Qatraq

William Echlin · Publicado 2006-06-29 · Atualizado 2018-10-18 · CVE-2006-3312

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions QaTraq versions 6.5 RC and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters in multiple files, including top.inc, components copy content.php, components modify content.php, components new content.php, design copy content.php, design copy plan search.php, design modify content.php, design new content.php, design new search.php, download.php, login.php, phase copy content.php, phase delete search.php, phase modify content.php, phase modify search.php, phase view search.php, and products copy content.php. The vulnerable parameters include link print, link upgrade, link sql, link next, link prev, link list, msg, component name, component desc, title, version, content, plan title, plan content, plan name, plan desc, file name, username, password, minor version, new version, product name, and product desc.

Recommendations For QaTraq versions 6.5 RC and earlier, update to version 6.8 RC or later to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2006-3312

Produtos afetados

Qatraq

Referências · 27

• 🔥 http://seclab.tuwien.ac.at/advisories/TUVSA-0606-001.txt · Exploit
• http://securitytracker.com/id?1016381 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27355 · Nota
• http://securityfocus.com/archive/1/438151/100/0/threaded · Nota
• http://osvdb.org/27599 · Nota
• http://osvdb.org/27605 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3312 · Nota de Segurança
• http://osvdb.org/27603 · Nota
• http://osvdb.org/27602 · Nota
• http://securityreason.com/securityalert/1169 · Nota
• http://osvdb.org/27613 · Nota
• http://osvdb.org/27615 · Nota
• http://osvdb.org/27601 · Nota
• http://osvdb.org/27606 · Nota
• http://securityfocus.com/bid/18620 · Nota