PT-2006-4220 · Custom Dating Biz · Custom Dating Biz Dating Script

Luny · Publicado 2006-06-30 · Atualizado 2017-07-20 · CVE-2006-3327

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Custom dating biz dating script version 1.0

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via specific parameters. The vulnerable parameters include the sn20 special cases parameter in the "Special Cases" field of profile/mini.php, the tyxx01 album name parameter in the "Album Name" field of profile/photo create.php, and the u parameter in admin/user view.php.

Recommendations For Custom dating biz dating script version 1.0, avoid using the sn20 special cases, tyxx01 album name, and u parameters in their respective API endpoints until a fix is available. As a temporary workaround, consider restricting access to the profile/mini.php, profile/photo create.php, and admin/user view.php pages to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2006-3327

Produtos afetados

Custom Dating Biz Dating Script

Referências · 7

• http://vupen.com/english/advisories/2006/2534 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27399 · Nota
• http://marc.info/?l=bugtraq&m=115109990800428&w=2 · Nota
• http://securityfocus.com/bid/18626 · Nota
• http://secunia.com/advisories/20839 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-3327 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27398 · Nota