PT-2006-3864 · I.List · I.List

Published 2006-06-12 · Updated 2008-09-05 · CVE-2006-2957

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions i.List versions 1.5 beta and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via the banurl parameter to "add.php" API endpoint. This enables attackers to execute malicious scripts on the victim's browser.

Recommendations For i.List versions 1.5 beta and earlier, avoid using the banurl parameter in the "add.php" endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the "add.php" endpoint to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-2957

Affected Products

I.List

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2006-2957 · Security Note
• http://secunia.com/advisories/20547 · Vendor Advisory