PT-2006-6339 · Ig · Ig Shop

Steven M. Christey · Published 2006-10-31 · Updated 2025-04-03 · CVE-2006-5631

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: iG Shop version 1.4

Description: The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote attackers to inject arbitrary web script or HTML via arbitrary query strings in the change pass.php file when the action parameter is not set to "1". This can be exploited by injecting script in the action parameter.

Recommendations: For iG Shop version 1.4, consider restricting access to the change pass.php file until a fix is available, and ensure that the action parameter is properly validated to prevent arbitrary input. As a temporary workaround, consider disabling the execution of scripts in query strings for the change pass.php file.

Exploit

Fix

Related Identifiers

CVE-2006-5631

Affected Products

Ig Shop

References · 6

• 🔥 http://securitytracker.com/id?1017130 · Exploit
• 🔥 http://attrition.org/pipermail/vim/2006-October/001099.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5631 · Security Note
• https://t.me/cvenotify/117584 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29890 · Note
• http://secunia.com/advisories/22701 · Note