PT-2004-2424 · Phpwebsite · Phpwebsite

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1516

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpWebSite version 0.9.3-4

Description The issue concerns a CRLF injection vulnerability. This allows remote attackers to perform HTTP Response Splitting attacks, which can modify the expected HTML content from the server. The block username parameter in the user module is specifically vulnerable to this type of attack.

Recommendations For phpWebSite version 0.9.3-4, consider restricting access to the user module or avoiding the use of the block username parameter until a fix is available. As a temporary workaround, disabling the vulnerable functionality in the index.php file may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-1516

Affected Products

Phpwebsite

References · 7

• 🔥 http://securityfocus.com/bid/11673 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1516 · Security Note
• http://phpwebsite.appstate.edu/index.php?module=announce&ANN_id=863&ANN_user_op=view · Patch
• http://secunia.com/advisories/13172 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200411-35.xml · Vendor Advisory
• http://marc.info/?l=bugtraq&m=110022027420583&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18046 · Note