PT-2006-6339 · Ig · Ig Shop

Steven M. Christey · CVE-2006-5631 · Publicado 2006-10-31 · Atualizado 2025-04-03

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: iG Shop version 1.4

Description: The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote attackers to inject arbitrary web script or HTML via arbitrary query strings in the change pass.php file when the action parameter is not set to "1". This can be exploited by injecting script in the action parameter.

Recommendations: For iG Shop version 1.4, consider restricting access to the change pass.php file until a fix is available, and ensure that the action parameter is properly validated to prevent arbitrary input. As a temporary workaround, consider disabling the execution of scripts in query strings for the change pass.php file.

Exploit

Correção

Identificadores relacionados

CVE-2006-5631

Produtos afetados

Ig Shop

Referências · 6

• 🔥 http://securitytracker.com/id?1017130 · Exploit
• 🔥 http://attrition.org/pipermail/vim/2006-October/001099.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5631 · Nota de Segurança
• https://t.me/cvenotify/117584 · Publicação no Telegram
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29890 · Nota
• http://secunia.com/advisories/22701 · Nota