PT-2006-2182 · Unknown · Site Membership Script

Published 2006-03-12 · Updated 2017-07-20 · CVE-2006-1155

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Site Membership Script versions prior to 8 March, 2006

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the Error parameter in API endpoints such as "login.asp" and "default.asp".

Recommendations For versions prior to 8 March, 2006, update to a version released after this date to resolve the issue.

Fix

Related Identifiers

CVE-2006-1155

Affected Products

Site Membership Script

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-1155 · Security Note
• http://secunia.com/advisories/19156 · Vendor Advisory
• http://manastungare.com/projects/site-membership · Patch
• http://securityfocus.com/bid/17045 · Note
• http://osvdb.org/23753 · Note
• http://vupen.com/english/advisories/2006/0884 · Note
• http://osvdb.org/23754 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25109 · Note