PT-2006-4488 · Chamberland Technology · Ezwaiter

Publicado 2006-07-14 · Atualizado 2018-10-18 · CVE-2006-3613

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Chamberland Technology ezWaiter version 3.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via vulnerable parameters. Specifically, the itemfor and special parameters to item.php, which is accessed from showorder.php, are affected. Additionally, unspecified parameters to the login form at login.php are vulnerable.

Recommendations For Chamberland Technology ezWaiter version 3.0, consider disabling access to the item.php and login.php scripts until a patch is available. Restrict input for the itemfor and special parameters to minimize the risk of exploitation. Avoid using unspecified parameters in the login form at login.php until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-3613

Produtos afetados

Ezwaiter

Referências · 4

• http://securityfocus.com/bid/18746 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3613 · Nota de Segurança
• http://securityfocus.com/archive/1/438792/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27587 · Nota