PT-2006-4258 · V3 · V3 Chat

Publicado 2006-07-06 · Atualizado 2018-10-18 · CVE-2006-3366

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions V3 Chat (affected versions not specified)

Description The issue allows remote attackers to inject arbitrary web script or HTML via crafted HTML tags. This can be achieved through various parameters in different PHP files, including the id parameter in mail/index.php and mail/reply.php, the login id parameter in members/is online.php, the site id parameter in messenger/online.php, messenger/search.php, and messenger/profile.php, the contact name parameter in messenger/search.php, the membername parameter in messenger/profileview.php, unspecified parameters when editing a profile, and the cust name parameter in messenger/expire.php. Note that the vendor disputes the involvement of files in the messenger directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-3366

Produtos afetados

V3 Chat

Referências · 13

• 🔥 https://exploit-db.com/exploits/28071 · Exploit
• 🔥 https://exploit-db.com/exploits/28074 · Exploit
• 🔥 https://exploit-db.com/exploits/28068 · Exploit
• 🔥 https://exploit-db.com/exploits/28072 · Exploit
• 🔥 https://exploit-db.com/exploits/28069 · Exploit
• 🔥 http://securitytracker.com/id?1016340 · Exploit
• 🔥 https://exploit-db.com/exploits/28073 · Exploit
• 🔥 https://exploit-db.com/exploits/28070 · Exploit
• http://securityfocus.com/archive/1/438069/100/200/threaded · Nota
• http://securityfocus.com/archive/1/437755/100/200/threaded · Nota
• http://vupen.com/english/advisories/2006/2474 · Nota
• http://securityfocus.com/bid/18543 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3366 · Nota de Segurança