PT-2006-2446 · Andy · Andy'S Php Knowledgebase

Published 2006-04-03 · Updated 2017-07-20 · CVE-2006-1438

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Andy's PHP Knowledgebase version 0.57

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various parameters in different PHP files, including the keyword list parameter to "index.php", the title, article, author, and keywords parameters to "submit article.php", and the Question, Name, and Email parameters to "submit question.php".

Recommendations For version 0.57, consider disabling the affected parameters, such as keyword list, title, article, author, keywords, Question, Name, and Email, until a patch is available. Restrict access to the vulnerable PHP files, including "index.php", "submit article.php", and "submit question.php", to minimize the risk of exploitation. Avoid using the mentioned parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-1438

Affected Products

Andy'S Php Knowledgebase

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-1438 · Security Note
• http://osvdb.org/24312 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25666 · Note
• http://osvdb.org/24310 · Note
• http://osvdb.org/ref/24/24310-aphpkb.txt · Note
• http://osvdb.org/24311 · Note
• http://securityfocus.com/bid/17377 · Note
• http://secunia.com/advisories/19554 · Note