PT-2005-4919 · Interempresas · Link Up Gold

Published 2005-12-14 · Updated 2011-03-08 · CVE-2005-4231

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Link Up Gold versions 2.5 and earlier

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the link parameter to "tell friend.php", the phrase[] parameter to "search.php" in a "search links advanced" action, and the direction or sort parameter to "articles.php".

Recommendations For Link Up Gold versions 2.5 and earlier, as a temporary workaround, consider restricting access to the "tell friend.php", "search.php", and "articles.php" scripts until a patch is available. Avoid using the link, phrase[], direction, and sort parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-4231

Affected Products

Link Up Gold

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-4231 · Security Note
• http://securityfocus.com/bid/15843 · Note
• http://vupen.com/english/advisories/2005/2884 · Note
• http://pridels0.blogspot.com/2005/12/link-up-gold-vuln.html · Note
• http://secunia.com/advisories/18031 · Note