PT-2006-3573 · Unknown · Vacation Rental Script

Luny · Published 2006-05-30 · Updated 2018-10-18 · CVE-2006-2651

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Vacation Rental Script version 1.0

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the obj parameter in the "index.php" file.

Recommendations For version 1.0, avoid using the obj parameter in the index.php file until a fix is available. As a temporary workaround, consider validating and sanitizing all input to the obj parameter to prevent malicious script injection.

Fix

Related Identifiers

CVE-2006-2651

Affected Products

Vacation Rental Script

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-2651 · Security Note
• http://secunia.com/advisories/20324 · Vendor Advisory
• http://securityfocus.com/archive/1/437938/100/200/threaded · Note
• http://securityreason.com/securityalert/982 · Note
• http://securityfocus.com/bid/18134 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26728 · Note
• http://securityfocus.com/archive/1/435167/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/2015 · Note