PT-2006-4460 · Jetbox · Jetbox Cms

Sven Krewitt · Publicado 2006-08-08 · Atualizado 2018-10-18 · CVE-2006-3585

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jetbox CMS version 2.1 SR1

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to security breaches. This can be achieved through various means, including the login parameter in admin/cms/index.php, unspecified parameters in the "Supply news" page in formmail.php, the URL in the "Site statistics" page, and the query string parameter when performing a search.

Recommendations For Jetbox CMS version 2.1 SR1, consider disabling the vulnerable parameters, such as the login parameter in admin/cms/index.php and the query string parameter in search functionality, until a patch is available. Restrict access to the "Supply news" page in formmail.php and the "Site statistics" page to minimize the risk of exploitation. Avoid using the query string parameter in the affected API endpoint until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-3585

Produtos afetados

Jetbox Cms

Referências · 10

• http://osvdb.org/27713 · Nota
• http://osvdb.org/27714 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3585 · Nota de Segurança
• http://securityreason.com/securityalert/1339 · Nota
• http://osvdb.org/27712 · Nota
• http://secunia.com/secunia_research/2006-57/advisory · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28164 · Nota
• http://securityfocus.com/archive/1/441980/100/0/threaded · Nota
• http://securityfocus.com/bid/19303 · Nota
• http://secunia.com/advisories/20889 · Aviso do Fabricante