PT-2005-1703 · D-Forum · D-Forum

Published 2005-03-07 · Updated 2008-09-05 · CVE-2005-0660

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions D-Forum version 1.11

Description The issue allows remote attackers to inject arbitrary web script or HTML via certain fields. This can be demonstrated using the page parameter in "nav.php3".

Recommendations For D-Forum version 1.11, consider validating and sanitizing user input to prevent the injection of malicious scripts or HTML, especially for the page parameter in "nav.php3". As a temporary workaround, restrict access to the "nav.php3" page until a proper fix is applied.

Fix

Related Identifiers

CVE-2005-0660

Affected Products

D-Forum

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2005-0660 · Security Note
• http://secunia.com/advisories/14464 · Note
• http://securitytracker.com/id?1013349 · Note