PT-2006-1926 · Noah · Noah'S Classifieds

Published 2006-02-24 · Updated 2018-10-18 · CVE-2006-0880

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Noah's Classifieds version 1.3

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the inf parameter. Additionally, when register globals is enabled, attackers can also inject scripts via the upperTemplate and lowerTemplate parameters.

Recommendations For Noah's Classifieds version 1.3, consider disabling the inf, upperTemplate, and lowerTemplate parameters in the index.php file to prevent exploitation until a patch is available. Restrict access to these parameters to minimize the risk of arbitrary web script or HTML injection.

Exploit

Fix

Related Identifiers

CVE-2006-0880

Affected Products

Noah'S Classifieds

References · 8

• 🔥 http://kapda.ir/advisory-268.html · Exploit
• 🔥 http://securityfocus.com/bid/16772 · Exploit
• 🔥 https://exploit-db.com/exploits/27259 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0880 · Security Note
• http://securityfocus.com/archive/1/425783/100/0/threaded · Note
• http://securitytracker.com/id?1015667 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24895 · Note
• http://vupen.com/english/advisories/2006/0703 · Note