PT-2006-3666 · F@Cile · F@Cile Interactive Web

Mustafa Can Bjorn Ipekci + 1 · Published 2006-06-01 · Updated 2018-10-18 · CVE-2006-2746

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions F@cile Interactive Web versions 0.8.5 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via the lang parameter in index.php, and the mytheme and myskin parameters in multiple "p-themes" index.inc.php files, including lowgraphic, classic, puzzle, simple, and ciao. It is noted that some vectors might be resultant from file inclusion issues.

Recommendations For F@cile Interactive Web versions 0.8.5 and earlier, consider disabling the lang, mytheme, and myskin parameters in the affected files until a patch is available. Restrict access to the index.php and "p-themes" index.inc.php files to minimize the risk of exploitation. Avoid using the lang, mytheme, and myskin parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-2746

Affected Products

F@Cile Interactive Web

References · 11

• 🔥 http://securityfocus.com/bid/18151 · Exploit
• 🔥 https://exploit-db.com/exploits/1841 · Exploit
• 🔥 http://secunia.com/advisories/20358 · Exploit
• 🔥 http://nukedx.com/?viewdoc=35 · Exploit
• 🔥 http://nukedx.com/?getxpl=35 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2746 · Security Note
• http://vupen.com/english/advisories/2006/2036 · Note
• http://osvdb.org/26104 · Note
• http://securityfocus.com/archive/1/435283/100/0/threaded · Note
• http://osvdb.org/26105 · Note
• http://securityreason.com/securityalert/1010 · Note