PT-2006-4226 · Zorum · Zorum Forum

Publicado 2006-06-30 · Atualizado 2017-07-20 · CVE-2006-3333

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zorum Forum version 3.5

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject web script or HTML via multiple unspecified parameters in index.php, including the frommethod, list, and method parameters, which are reflected in an error message. This might be related to SQL injection in some cases.

Recommendations For Zorum Forum version 3.5, as a temporary workaround, consider restricting access to the index.php file or validating and sanitizing user input for the frommethod, list, and method parameters to prevent XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-3333

Produtos afetados

Zorum Forum

Referências · 3

• https://exchange.xforce.ibmcloud.com/vulnerabilities/19598 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3333 · Nota de Segurança
• http://pridels0.blogspot.com/2006/06/zorum-forum-35-vuln.html · Nota