PT-2006-2659 · Unknown · Arab Portal

Published 2006-04-07 · Updated 2018-10-18 · CVE-2006-1665

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Arab Portal version 2.0.1

Description: The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in various PHP files. This is achieved through the adminJump and forum middle parameters in forum.php, and the form parameter in members.php, pm.php, and mail.php.

Recommendations: For Arab Portal version 2.0.1, consider restricting access to the adminJump and forum middle parameters in forum.php, and the form parameter in members.php, pm.php, and mail.php to minimize the risk of exploitation. As a temporary workaround, avoid using these parameters in the affected API endpoints until the issue is resolved.

Fix

Related Identifiers

CVE-2006-1665

Affected Products

Arab Portal

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-1665 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1665 · Note
• http://securityfocus.com/bid/17375 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25657 · Note
• http://securityfocus.com/archive/1/429940/100/0/threaded · Note