PT-2005-2584 · Psoft · Sitestudio

Donnie Werner · Published 2005-05-16 · Updated 2017-07-11 · CVE-2005-1605

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SiteStudio version 1.6

Description A cross-site scripting (XSS) issue exists in the guestbook component, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved via the name field in either the psoft.guestbook.GuestBookServ in Standalone Site Studio or the E-Guest sign.pl in Integrated Site Studio with H-Sphere.

Recommendations For SiteStudio version 1.6, consider disabling the guestbook component until a patch is available to prevent exploitation. Restrict access to the psoft.guestbook.GuestBookServ and E-Guest sign.pl to minimize the risk of XSS attacks. Avoid using the name field in the affected guestbook component until the issue is resolved.

Fix

Related Identifiers

CVE-2005-1605

Affected Products

Sitestudio

References · 9

• http://exploitlabs.com/files/advisories/EXPL-A-2005-008-sitestudio.txt · Patch
• http://derkeiler.com/Mailing-Lists/Full-Disclosure/2005-05/0154.html · Patch
• http://secunia.com/advisories/15286 · Patch
• http://psoft.net/misc/hsphere_winbox_security_update_guestbook.html · Patch
• http://psoft.net/SS/ss_16_security_update_guestbook.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-1605 · Security Note
• http://securityfocus.com/bid/13554 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20496 · Note
• http://osvdb.org/16240 · Note