PT-2006-5867 · Ph03Y3Nk · Ph03Y3Nk Just Another Flat File (Jaf) Cms

Nanoymaster · Publicado 2006-10-02 · Atualizado 2018-10-17 · CVE-2006-5129

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ph03y3nk just another flat file (JAF) CMS version 4.0 RC1

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via the message parameter in the /module/shout/jafshout.php endpoint, and possibly other parameters. Additionally, the issue can be exploited through the message body in a forum post in the /module/forum/topicwin.php endpoint, related to the name, email, title, date, ldate, and lname variables.

Recommendations For ph03y3nk just another flat file (JAF) CMS version 4.0 RC1, consider disabling the shoutbox functionality in module/shout/jafshout.php and restricting user input in the forum post functionality in module/forum/topicwin.php to minimize the risk of exploitation. Avoid using the message parameter in the /module/shout/jafshout.php endpoint and the name, email, title, date, ldate, and lname variables in the /module/forum/topicwin.php endpoint until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-5129

Produtos afetados

Ph03Y3Nk Just Another Flat File (Jaf) Cms

Referências · 5

• http://securityfocus.com/archive/1/447081/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5129 · Nota de Segurança
• http://secunia.com/advisories/22143 · Aviso do Fabricante
• http://securityreason.com/securityalert/1674 · Nota
• http://securityfocus.com/bid/20225 · Nota