PT-2004-2471 · W Agora · W-Agora

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1563

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions w-Agora version 4.1.6a

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary web script or HTML. The affected API endpoints include "download thread.php", "login.php", and "forgot password.php". Specifically, the thread parameter to "download thread.php", the loginuser parameter to "login.php", and the userid parameter to "forgot password.php" are vulnerable.

Recommendations For w-Agora version 4.1.6a, consider disabling the execution of web scripts or HTML in the affected parameters as a temporary workaround. Restrict access to the vulnerable endpoints "download thread.php", "login.php", and "forgot password.php" to minimize the risk of exploitation. Avoid using the thread, loginuser, and userid parameters in the respective endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-1563

Affected Products

W-Agora

References · 11

• 🔥 https://exploit-db.com/exploits/24652 · Exploit
• 🔥 http://securityfocus.com/bid/11283 · Exploit
• 🔥 https://exploit-db.com/exploits/24649 · Exploit
• 🔥 https://exploit-db.com/exploits/24650 · Exploit
• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/027040.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1563 · Security Note
• http://secunia.com/advisories/12695 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1563 · Note
• http://securitytracker.com/id?1011463 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17553 · Note
• http://marc.info/?l=bugtraq&m=109655691512298&w=2 · Note