PT-2006-5323 · Unknown · Membrepass

Darkfig · Published 2006-09-01 · Updated 2018-10-17 · CVE-2006-4528

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions membrepass version 1.5

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the "recherche" parameter in "recherchemembre.php" and the "email" parameter in "test.php" are vulnerable.

Recommendations For membrepass version 1.5, consider restricting access to the "recherchemembre.php" and "test.php" scripts until a fix is available, and avoid using the recherche and email parameters in these scripts to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-4528

Affected Products

Membrepass

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-4528 · Security Note
• http://secunia.com/advisories/21715 · Vendor Advisory
• http://acid-root.new.fr/advisories/09290806.txt · Note
• http://securityfocus.com/archive/1/444845/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28691 · Note
• http://securityreason.com/securityalert/1487 · Note
• http://vupen.com/english/advisories/2006/3427 · Note
• http://securityfocus.com/bid/19789 · Note