PT-2007-1738 · Ezboxx · Ezboxx Portal System

Publicado 2007-01-16 · Atualizado 2018-10-16 · CVE-2007-0266

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ezboxx Portal System versions prior to 0.7.6

Description The issue allows remote attackers to inject arbitrary web script or HTML via the iid parameter in the boxx/ShowAppendix.asp file. This can lead to the execution of malicious code on the affected system.

Recommendations For versions prior to 0.7.6, as a temporary workaround, consider restricting access to the boxx/ShowAppendix.asp file until a patch is available. Avoid using the iid parameter in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2007-0266

Produtos afetados

Ezboxx Portal System

Referências · 7

• http://osvdb.org/32825 · Nota
• http://bugsec.com/articles.php?Security=20 · Nota
• http://vupen.com/english/advisories/2007/0208 · Nota
• http://osvdb.org/33466 · Nota
• http://secunia.com/advisories/23759 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0266 · Nota de Segurança
• http://securityfocus.com/archive/1/456699/100/0/threaded · Nota