PT-2006-4258 · V3 · V3 Chat

Published 2006-07-06 · Updated 2018-10-18 · CVE-2006-3366

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions V3 Chat (affected versions not specified)

Description The issue allows remote attackers to inject arbitrary web script or HTML via crafted HTML tags. This can be achieved through various parameters in different PHP files, including the id parameter in mail/index.php and mail/reply.php, the login id parameter in members/is online.php, the site id parameter in messenger/online.php, messenger/search.php, and messenger/profile.php, the contact name parameter in messenger/search.php, the membername parameter in messenger/profileview.php, unspecified parameters when editing a profile, and the cust name parameter in messenger/expire.php. Note that the vendor disputes the involvement of files in the messenger directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-3366

Affected Products

V3 Chat

References · 13

• 🔥 https://exploit-db.com/exploits/28071 · Exploit
• 🔥 https://exploit-db.com/exploits/28074 · Exploit
• 🔥 https://exploit-db.com/exploits/28068 · Exploit
• 🔥 https://exploit-db.com/exploits/28072 · Exploit
• 🔥 https://exploit-db.com/exploits/28069 · Exploit
• 🔥 http://securitytracker.com/id?1016340 · Exploit
• 🔥 https://exploit-db.com/exploits/28073 · Exploit
• 🔥 https://exploit-db.com/exploits/28070 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3366 · Security Note
• http://securityfocus.com/archive/1/438069/100/200/threaded · Note
• http://securityfocus.com/archive/1/437755/100/200/threaded · Note
• http://vupen.com/english/advisories/2006/2474 · Note
• http://securityfocus.com/bid/18543 · Note