PT-2007-1738 · Ezboxx · Ezboxx Portal System

Published 2007-01-16 · Updated 2018-10-16 · CVE-2007-0266

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ezboxx Portal System versions prior to 0.7.6

Description The issue allows remote attackers to inject arbitrary web script or HTML via the iid parameter in the boxx/ShowAppendix.asp file. This can lead to the execution of malicious code on the affected system.

Recommendations For versions prior to 0.7.6, as a temporary workaround, consider restricting access to the boxx/ShowAppendix.asp file until a patch is available. Avoid using the iid parameter in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2007-0266

Affected Products

Ezboxx Portal System

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-0266 · Security Note
• http://osvdb.org/32825 · Note
• http://bugsec.com/articles.php?Security=20 · Note
• http://vupen.com/english/advisories/2007/0208 · Note
• http://osvdb.org/33466 · Note
• http://secunia.com/advisories/23759 · Note
• http://securityfocus.com/archive/1/456699/100/0/threaded · Note