PT-2005-4341 · Php · Phpkit

Published 2005-11-16 · Updated 2017-07-11 · CVE-2005-3552

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHPKIT versions 1.6.1 R2 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple vectors, including the login/profile.php, login/userinfo.php, admin/admin.php, imcenter.php, referer statistics, HTML title element, logo alt attributes in forum postings, and the Homepage field in the Guestbook.

Recommendations For PHPKIT versions 1.6.1 R2 and earlier, update to a version later than 1.6.1 R2 to resolve the issue. As a temporary workaround, consider restricting access to the affected files, such as login/profile.php, login/userinfo.php, admin/admin.php, and imcenter.php, until a patch is available. Avoid using the vulnerable fields, such as the Homepage field in the Guestbook, and the logo alt attributes in forum postings, until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2005-3552

Affected Products

Phpkit

References · 21

• http://hardened-php.net/advisory_212005.80.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3552 · Security Note
• http://vupen.com/english/advisories/2005/2344 · Vendor Advisory
• http://secunia.com/advisories/17479 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23003 · Note
• http://osvdb.org/20554 · Note
• http://osvdb.org/20558 · Note
• http://securitytracker.com/id?1015167 · Note
• http://securityfocus.com/bid/15354 · Note
• http://osvdb.org/20553 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23007 · Note
• http://osvdb.org/20557 · Note
• http://osvdb.org/20555 · Note
• http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00110.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23006 · Note