PT-2007-1209 · Rapid · Rapid Classified

Published 2007-01-13 · Updated 2024-02-14 · CVE-2006-6929

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Rapid Classified version 3.1

Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various parameters in different scripts, including the id parameter to "reply.asp" or "view print.asp", the SH1 parameter to "search.asp", the name parameter to "reply.asp", or the dosearch parameter to "advsearch.asp".

Recommendations: For Rapid Classified version 3.1, consider restricting access to the vulnerable parameters id, SH1, name, and dosearch in their respective scripts until a patch is available. As a temporary workaround, disabling the execution of scripts in "reply.asp", "view print.asp", "search.asp", and "advsearch.asp" can help minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-6929

Affected Products

Rapid Classified

References · 12

• 🔥 http://securityfocus.com/bid/21197 · Exploit
• 🔥 https://exploit-db.com/exploits/29135 · Exploit
• 🔥 https://exploit-db.com/exploits/29136 · Exploit
• 🔥 https://exploit-db.com/exploits/29134 · Exploit
• 🔥 https://exploit-db.com/exploits/29137 · Exploit
• http://secunia.com/advisories/22985 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6929 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30450 · Note
• http://securityfocus.com/archive/1/452088/100/0/threaded · Note
• http://securityreason.com/securityalert/2142 · Note
• http://s-a-p.ca/index.php?page=OurAdvisories&id=44 · Note
• http://vupen.com/english/advisories/2006/4632 · Note