PT-2005-4523 · Php · Php-Post

Published 2005-11-23 · Updated 2024-02-14 · CVE-2005-3770

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Post (PHPp) version 1.0

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through the subject in a post or by manipulating the user parameter in specific API endpoints, such as "profile.php" and "mail.php".

Recommendations For PHP-Post (PHPp) version 1.0, consider validating and sanitizing user input for the subject in posts and the user parameter in "profile.php" and "mail.php" to prevent arbitrary script injection. As a temporary workaround, restrict access to these endpoints until a proper fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2005-3770

Affected Products

Php-Post

References · 11

• 🔥 https://exploit-db.com/exploits/26547 · Exploit
• 🔥 https://exploit-db.com/exploits/26546 · Exploit
• 🔥 http://irannetjob.com/content/view/168/28 · Exploit
• 🔥 http://securityfocus.com/bid/15524 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-3770 · Security Note
• http://secunia.com/advisories/17706 · Vendor Advisory
• http://vupen.com/english/advisories/2005/2533 · Vendor Advisory
• http://securityfocus.com/archive/1/417434/30/0/threaded · Note
• http://osvdb.org/21059 · Note
• http://osvdb.org/21057 · Note
• http://securityfocus.com/bid/15532 · Note