PT-2006-4226 · Zorum · Zorum Forum

Published 2006-06-30 · Updated 2017-07-20 · CVE-2006-3333

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zorum Forum version 3.5

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject web script or HTML via multiple unspecified parameters in index.php, including the frommethod, list, and method parameters, which are reflected in an error message. This might be related to SQL injection in some cases.

Recommendations For Zorum Forum version 3.5, as a temporary workaround, consider restricting access to the index.php file or validating and sanitizing user input for the frommethod, list, and method parameters to prevent XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-3333

Affected Products

Zorum Forum

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2006-3333 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19598 · Note
• http://pridels0.blogspot.com/2006/06/zorum-forum-35-vuln.html · Note