PT-2006-4205 · Qatraq · Qatraq

William Echlin · Published 2006-06-29 · Updated 2018-10-18 · CVE-2006-3312

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions QaTraq versions 6.5 RC and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters in multiple files, including top.inc, components copy content.php, components modify content.php, components new content.php, design copy content.php, design copy plan search.php, design modify content.php, design new content.php, design new search.php, download.php, login.php, phase copy content.php, phase delete search.php, phase modify content.php, phase modify search.php, phase view search.php, and products copy content.php. The vulnerable parameters include link print, link upgrade, link sql, link next, link prev, link list, msg, component name, component desc, title, version, content, plan title, plan content, plan name, plan desc, file name, username, password, minor version, new version, product name, and product desc.

Recommendations For QaTraq versions 6.5 RC and earlier, update to version 6.8 RC or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2006-3312

Affected Products

Qatraq

References · 27

• 🔥 http://seclab.tuwien.ac.at/advisories/TUVSA-0606-001.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3312 · Security Note
• http://securitytracker.com/id?1016381 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27355 · Note
• http://securityfocus.com/archive/1/438151/100/0/threaded · Note
• http://osvdb.org/27599 · Note
• http://osvdb.org/27605 · Note
• http://osvdb.org/27603 · Note
• http://osvdb.org/27602 · Note
• http://securityreason.com/securityalert/1169 · Note
• http://osvdb.org/27613 · Note
• http://osvdb.org/27615 · Note
• http://osvdb.org/27601 · Note
• http://osvdb.org/27606 · Note
• http://securityfocus.com/bid/18620 · Note