PT-2006-5323 · Unknown · Membrepass

Darkfig · Publicado 2006-09-01 · Atualizado 2018-10-17 · CVE-2006-4528

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions membrepass version 1.5

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the "recherche" parameter in "recherchemembre.php" and the "email" parameter in "test.php" are vulnerable.

Recommendations For membrepass version 1.5, consider restricting access to the "recherchemembre.php" and "test.php" scripts until a fix is available, and avoid using the recherche and email parameters in these scripts to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-4528

Produtos afetados

Membrepass

Referências · 8

• http://acid-root.new.fr/advisories/09290806.txt · Nota
• http://securityfocus.com/archive/1/444845/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4528 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28691 · Nota
• http://secunia.com/advisories/21715 · Aviso do Fabricante
• http://securityreason.com/securityalert/1487 · Nota
• http://vupen.com/english/advisories/2006/3427 · Nota
• http://securityfocus.com/bid/19789 · Nota