PT-2006-4220 · Custom Dating Biz · Custom Dating Biz Dating Script

Luny · Published 2006-06-30 · Updated 2017-07-20 · CVE-2006-3327

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Custom dating biz dating script version 1.0

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via specific parameters. The vulnerable parameters include the sn20 special cases parameter in the "Special Cases" field of profile/mini.php, the tyxx01 album name parameter in the "Album Name" field of profile/photo create.php, and the u parameter in admin/user view.php.

Recommendations For Custom dating biz dating script version 1.0, avoid using the sn20 special cases, tyxx01 album name, and u parameters in their respective API endpoints until a fix is available. As a temporary workaround, consider restricting access to the profile/mini.php, profile/photo create.php, and admin/user view.php pages to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2006-3327

Affected Products

Custom Dating Biz Dating Script

References · 7

• http://secunia.com/advisories/20839 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3327 · Security Note
• http://vupen.com/english/advisories/2006/2534 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27399 · Note
• http://marc.info/?l=bugtraq&m=115109990800428&w=2 · Note
• http://securityfocus.com/bid/18626 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27398 · Note