PT-2006-4173 · Aedating · Aedating

Published 2006-06-28 · Updated 2018-10-18 · CVE-2006-3279

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions aeDating version 4.1

Description The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via specific parameters in certain PHP files. The vulnerable parameters include the Sex parameter in "index.php", the ProfileType parameter in "join form.php", and the Email parameter in "forgot.php".

Recommendations For aeDating version 4.1, consider validating and sanitizing user input for the Sex, ProfileType, and Email parameters to prevent XSS attacks. As a temporary workaround, restrict access to the affected PHP files until a patch is available.

Fix

Related Identifiers

CVE-2006-3279

Affected Products

Aedating

References · 8

• http://secunia.com/advisories/20820 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3279 · Security Note
• http://osvdb.org/26830 · Note
• http://securityfocus.com/archive/1/438157/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/2533 · Note
• http://osvdb.org/26832 · Note
• http://osvdb.org/26831 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27339 · Note