PT-2007-2988 · W Agora · W-Agora

Publicado 2007-03-22 · Atualizado 2018-10-16 · CVE-2007-1606

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions w-Agora (Web-Agora) (affected versions not specified)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected parameters include showuser in "profile.php", search forum or search user in "search.php", and userid in "change password.php".

Recommendations For all affected versions, consider disabling the parameters showuser, search forum, search user, and userid in their respective scripts until a fix is available. Restrict access to the scripts "profile.php", "search.php", and "change password.php" to minimize the risk of exploitation. Avoid using the parameters showuser, search forum, search user, and userid in the affected scripts until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-1606

Produtos afetados

W-Agora

Referências · 13

• 🔥 https://exploit-db.com/exploits/29764 · Exploit
• 🔥 https://exploit-db.com/exploits/29766 · Exploit
• 🔥 https://exploit-db.com/exploits/29765 · Exploit
• http://securityfocus.com/bid/23057 · Nota
• http://osvdb.org/34378 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1606 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33175 · Nota
• http://osvdb.org/34377 · Nota
• http://secunia.com/advisories/24605 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1606 · Nota
• http://securityfocus.com/archive/1/463286/100/0/threaded · Nota
• http://securityreason.com/securityalert/2462 · Nota
• http://osvdb.org/34379 · Nota