PT-2005-4748 · Php · Php Web Statistik

Ascii + 1 · Published 2005-12-05 · Updated 2017-07-20 · CVE-2005-4012

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP Web Statistik version 1.4

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities can be exploited via the lastnumber parameter to "stat.php" and the HTTP referer to "pixel.php".

Recommendations For PHP Web Statistik version 1.4, consider restricting access to the "stat.php" and "pixel.php" files until a patch is available. As a temporary workaround, avoid using the lastnumber parameter in the "stat.php" file. Additionally, restrict the HTTP referer to "pixel.php" to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-4012

Affected Products

Php Web Statistik

References · 11

• 🔥 http://ush.it/2005/11/19/php-web-statistik · Exploit
• http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00325.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4012 · Security Note
• http://secunia.com/advisories/17789 · Vendor Advisory
• http://osvdb.org/21212 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23379 · Note
• http://osvdb.org/21208 · Note
• http://vupen.com/english/advisories/2005/2645 · Note
• http://freewebstat.com/changelog-english.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23385 · Note
• http://securityfocus.com/bid/15603 · Note