PT-2004-2557 · Phpscheduleit · Phpscheduleit

Published 2004-08-31 · Updated 2017-07-11 · CVE-2004-1651

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpScheduleIt version 1.0.0 RC1

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the registration page. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific fields, including the Name field, Lastname field during new user registration, or the Schedule Name field.

Recommendations For phpScheduleIt version 1.0.0 RC1, as a temporary workaround, consider validating and sanitizing user input for the Name, Lastname, and Schedule Name fields to prevent XSS attacks. Restrict access to these fields until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-1651

Affected Products

Phpscheduleit

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2004-1651 · Security Note
• http://securityfocus.com/bid/11080 · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2004-09/0216.html · Note
• http://osvdb.org/9451 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1651 · Note
• http://marc.info/?l=bugtraq&m=109399590602709&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17193 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17194 · Note
• http://securitytracker.com/id?1011127 · Note