PT-2004-1476 · Xmb Forum · Xmb

Janek Vind + 1 · Published 2004-02-23 · Updated 2021-04-29 · CVE-2004-0322

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions XMB version 1.8 Final SP2

Description The issue allows remote attackers to execute arbitrary script as other users. This can be achieved through various means, including the member parameter in "member.php", the uid parameter in "u2uadmin.php", the user parameter in "editprofile.php", an onmouseover event in an align tag when bbcode is allowed, or an img tag where bbcode is allowed.

Recommendations For XMB version 1.8 Final SP2, consider disabling the execution of scripts in the mentioned parameters and tags until a patch is available. Restrict access to the "member.php", "u2uadmin.php", and "editprofile.php" files to minimize the risk of exploitation. Avoid using the member, uid, and user parameters in the affected files, and disable the use of onmouseover events in align tags and img tags when bbcode is allowed.

Exploit

Fix

Related Identifiers

CVE-2004-0322

Affected Products

Xmb

References · 11

• 🔥 https://exploit-db.com/exploits/23746 · Exploit
• 🔥 https://exploit-db.com/exploits/23745 · Exploit
• 🔥 https://exploit-db.com/exploits/23747 · Exploit
• 🔥 http://securityfocus.com/bid/9726 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0322 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15294 · Note
• http://xmbforum.com/community/boards/viewthread.php?tid=746859 · Note
• https://docs.xmbforum2.com/index.php?title=Security_Issue_History · Note
• http://marc.info/?l=bugtraq&m=107756526625179&w=2 · Note
• http://archives.neohapsis.com/archives/bugtraq/2004-02/0645.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15292 · Note