PT-2007-2959 · Phprojekt · Phprojekt

Published 2007-03-21 · Updated 2018-10-16 · CVE-2007-1576

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHProjekt version 5.2.0

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors to various modules, including Projects, Contacts, Helpdesk, Search (only in Gecko engine driven Browsers), and Notes, as well as the Mail summary page and other unspecified files, when magic quotes gpc is disabled.

Recommendations For PHProjekt version 5.2.0, consider disabling the affected modules, such as Projects, Contacts, Helpdesk, Search, and Notes, until a patch is available. Restrict access to the Mail summary page to minimize the risk of exploitation. Additionally, enable magic quotes gpc to prevent the injection of arbitrary web script or HTML.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-1576

Affected Products

Phprojekt

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2007-1576 · Security Note
• http://phprojekt.com/index.php?name=News&file=article&sid=276 · Vendor Advisory
• http://nruns.de/security_advisory_phprojekt_xss_and_filter_evasion.php · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200706-07.xml · Vendor Advisory
• http://securityfocus.com/archive/1/462788/100/0/threaded · Note
• http://secunia.com/advisories/24509 · Note
• http://osvdb.org/34066 · Note
• http://secunia.com/advisories/25748 · Note
• http://securityfocus.com/bid/22957 · Note
• http://osvdb.org/34068 · Note
• http://securityreason.com/securityalert/2459 · Note
• http://osvdb.org/34067 · Note
• http://osvdb.org/34069 · Note
• http://osvdb.org/34064 · Note
• http://osvdb.org/34065 · Note