PT-2006-5867 · Ph03Y3Nk · Ph03Y3Nk Just Another Flat File (Jaf) Cms

Nanoymaster · Published 2006-10-02 · Updated 2018-10-17 · CVE-2006-5129

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ph03y3nk just another flat file (JAF) CMS version 4.0 RC1

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via the message parameter in the /module/shout/jafshout.php endpoint, and possibly other parameters. Additionally, the issue can be exploited through the message body in a forum post in the /module/forum/topicwin.php endpoint, related to the name, email, title, date, ldate, and lname variables.

Recommendations For ph03y3nk just another flat file (JAF) CMS version 4.0 RC1, consider disabling the shoutbox functionality in module/shout/jafshout.php and restricting user input in the forum post functionality in module/forum/topicwin.php to minimize the risk of exploitation. Avoid using the message parameter in the /module/shout/jafshout.php endpoint and the name, email, title, date, ldate, and lname variables in the /module/forum/topicwin.php endpoint until the issue is resolved.

Fix

Related Identifiers

CVE-2006-5129

Affected Products

Ph03Y3Nk Just Another Flat File (Jaf) Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-5129 · Security Note
• http://secunia.com/advisories/22143 · Vendor Advisory
• http://securityfocus.com/archive/1/447081/100/0/threaded · Note
• http://securityreason.com/securityalert/1674 · Note
• http://securityfocus.com/bid/20225 · Note