PT-2006-4460 · Jetbox · Jetbox Cms

Sven Krewitt · Published 2006-08-08 · Updated 2018-10-18 · CVE-2006-3585

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jetbox CMS version 2.1 SR1

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to security breaches. This can be achieved through various means, including the login parameter in admin/cms/index.php, unspecified parameters in the "Supply news" page in formmail.php, the URL in the "Site statistics" page, and the query string parameter when performing a search.

Recommendations For Jetbox CMS version 2.1 SR1, consider disabling the vulnerable parameters, such as the login parameter in admin/cms/index.php and the query string parameter in search functionality, until a patch is available. Restrict access to the "Supply news" page in formmail.php and the "Site statistics" page to minimize the risk of exploitation. Avoid using the query string parameter in the affected API endpoint until the issue is resolved.

Fix

Related Identifiers

CVE-2006-3585

Affected Products

Jetbox Cms

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-3585 · Security Note
• http://secunia.com/secunia_research/2006-57/advisory · Vendor Advisory
• http://secunia.com/advisories/20889 · Vendor Advisory
• http://osvdb.org/27713 · Note
• http://osvdb.org/27714 · Note
• http://securityreason.com/securityalert/1339 · Note
• http://osvdb.org/27712 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28164 · Note
• http://securityfocus.com/archive/1/441980/100/0/threaded · Note
• http://securityfocus.com/bid/19303 · Note