PT-2006-2439 · Fusionzone · Fusionzone Couponzone

Published 2006-03-28 · Updated 2017-07-20 · CVE-2006-1431

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions fusionZONE couponZONE version 4.2

Description The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via URL-encoded parameters, specifically the srchfor and srchby parameters.

Recommendations For fusionZONE couponZONE version 4.2, update the local.cfm file to properly encode and validate user input for the srchfor and srchby parameters to prevent XSS attacks. As a temporary workaround, consider restricting access to the local.cfm file until a patch is available. Avoid using the srchfor and srchby parameters in the affected URL until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-1431

Affected Products

Fusionzone Couponzone

References · 8

• 🔥 http://securityfocus.com/bid/17272 · Exploit
• 🔥 https://exploit-db.com/exploits/27489 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1431 · Security Note
• http://secunia.com/advisories/19430 · Vendor Advisory
• http://vupen.com/english/advisories/2006/1127 · Note
• http://osvdb.org/24180 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25484 · Note
• http://pridels0.blogspot.com/2006/03/couponzone-v42-multiple-vuln.html · Note