PT-2007-2720 · Sava · Sava'S Guestbook

CVE-2007-1305 · Publicado 2007-03-07 · Atualizado 2024-02-14

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sava's Guestbook version 23.11.2006

Description The issue allows remote attackers to inject arbitrary web script or HTML via the name, country, email, and website parameters in the add2.php file. This can lead to cross-site scripting (XSS) attacks.

Recommendations For Sava's Guestbook version 23.11.2006, consider validating and sanitizing user input for the name, country, email, and website parameters to prevent XSS attacks. As a temporary workaround, restrict access to the add2.php file until a proper fix is applied.

Correção

Identificadores relacionados

CVE-2007-1305

Produtos afetados

Sava'S Guestbook

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-1305 · Nota de Segurança
• http://securityreason.com/securityalert/2350 · Nota
• http://securityfocus.com/bid/22820 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32812 · Nota
• http://secunia.com/advisories/24411 · Nota
• http://belsec.com/advisories/142/summary.html · Nota
• http://securityfocus.com/archive/1/461910/100/0/threaded · Nota