PT-2007-6881 · Sf · Sf-Shoutbox

Publicado 2007-11-14 · Atualizado 2011-03-08 · CVE-2007-5948

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SF-Shoutbox versions 1.2.1 through 1.4

Description The issue allows remote attackers to inject arbitrary web script or HTML via the nick and shout parameters in the main.php file. This can be exploited by sending malicious input to the affected parameters.

Recommendations For SF-Shoutbox versions 1.2.1 through 1.4, consider validating and sanitizing user input for the nick and shout parameters to prevent arbitrary web script or HTML injection. As a temporary workaround, restrict access to the main.php file until a fix is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-5948

Produtos afetados

Sf-Shoutbox

Referências · 6

• http://osvdb.org/38401 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5948 · Nota de Segurança
• http://secunia.com/advisories/27487 · Aviso do Fabricante
• http://securityfocus.com/bid/26320 · Nota
• http://vupen.com/english/advisories/2007/3722 · Nota
• http://smash-the-stack.net/articles/SF-Shoutbox_Injection_Advisory.txt · Nota