PT-2006-4223 · Unknown · Php/Mysql Classifieds

Luny · Published 2006-06-30 · Updated 2018-10-18 · CVE-2006-3330

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP/MySQL Classifieds (affected versions not specified)

Description The issue is related to a cross-site scripting (XSS) vulnerability in the AddAsset1.php file. This vulnerability allows remote attackers to execute arbitrary SQL commands by manipulating certain parameters, including the ProductName ("Title" field), url, and Description parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-3330

Affected Products

Php/Mysql Classifieds

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2006-3330 · Security Note
• http://secunia.com/advisories/20880 · Vendor Advisory
• http://vupen.com/english/advisories/2006/2589 · Note
• http://securityfocus.com/archive/1/438667/100/0/threaded · Note
• http://securityfocus.com/bid/18717 · Note
• http://securityfocus.com/bid/18713 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27454 · Note
• http://securitytracker.com/id?1016407 · Note
• http://securityreason.com/securityalert/1179 · Note