PT-2007-2959 · Phprojekt · Phprojekt

Publicado 2007-03-21 · Atualizado 2018-10-16 · CVE-2007-1576

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHProjekt version 5.2.0

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors to various modules, including Projects, Contacts, Helpdesk, Search (only in Gecko engine driven Browsers), and Notes, as well as the Mail summary page and other unspecified files, when magic quotes gpc is disabled.

Recommendations For PHProjekt version 5.2.0, consider disabling the affected modules, such as Projects, Contacts, Helpdesk, Search, and Notes, until a patch is available. Restrict access to the Mail summary page to minimize the risk of exploitation. Additionally, enable magic quotes gpc to prevent the injection of arbitrary web script or HTML.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-1576

Produtos afetados

Phprojekt

Referências · 15

• https://nvd.nist.gov/vuln/detail/CVE-2007-1576 · Nota de Segurança
• http://phprojekt.com/index.php?name=News&file=article&sid=276 · Aviso do Fabricante
• http://securityfocus.com/archive/1/462788/100/0/threaded · Nota
• http://secunia.com/advisories/24509 · Nota
• http://osvdb.org/34066 · Nota
• http://secunia.com/advisories/25748 · Nota
• http://securityfocus.com/bid/22957 · Nota
• http://nruns.de/security_advisory_phprojekt_xss_and_filter_evasion.php · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200706-07.xml · Aviso do Fabricante
• http://osvdb.org/34068 · Nota
• http://securityreason.com/securityalert/2459 · Nota
• http://osvdb.org/34067 · Nota
• http://osvdb.org/34069 · Nota
• http://osvdb.org/34064 · Nota
• http://osvdb.org/34065 · Nota