PT-2005-4488 · Phpmyfaq · Phpmyfaq

Tobias Klein · Published 2005-11-22 · Updated 2018-10-19 · CVE-2005-3734

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 1.5.3 and earlier

Description A cross-site scripting (XSS) issue exists in the "add content" page, allowing remote attackers to inject arbitrary web script or HTML via the thema, username, and usermail parameters.

Recommendations For phpMyFAQ versions 1.5.3 and earlier, as a temporary workaround, consider restricting access to the "add content" page until a patch is available. Avoid using the thema, username, and usermail parameters in the affected page until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-3734

Affected Products

Phpmyfaq

References · 10

• 🔥 http://trapkit.de/advisories/TKADV2005-11-004.txt · Exploit
• http://phpmyfaq.de/advisory_2005-11-18.php · Vendor Advisory
• http://securityfocus.com/bid/15504 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-3734 · Security Note
• http://secunia.com/advisories/17649 · Vendor Advisory
• http://osvdb.org/20989 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3734 · Note
• http://securityreason.com/securityalert/196 · Note
• http://vupen.com/english/advisories/2005/2505 · Note
• http://securityfocus.com/archive/1/417219/30/0/threaded · Note