PT-2005-5221 · Simpbook · Simpbook

0O_Zeus_O0 · Published 2005-12-28 · Updated 2016-10-18 · CVE-2005-4551

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SimpBook version 1.0

Description A cross-site scripting (XSS) issue exists due to the failure to properly sanitize user input. When the html enable option is enabled, remote attackers can inject arbitrary web script or HTML via the message parameter to "index.php". This allows for the execution of malicious code on the victim's browser.

Recommendations For SimpBook version 1.0, as a temporary workaround, consider disabling the html enable option until a patch is available. Restrict access to the "index.php" endpoint to minimize the risk of exploitation. Avoid using the message parameter in the affected endpoint until the issue is resolved.

Fix

Related Identifiers

CVE-2005-4551

Affected Products

Simpbook

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-4551 · Security Note
• http://secunia.com/advisories/18256 · Vendor Advisory
• http://marc.info/?l=full-disclosure&m=113535570125766&w=2 · Note
• http://securityfocus.com/bid/16058 · Note
• http://securityfocus.com/bid/16053 · Note