PT-2007-2988 · W Agora · W-Agora

Published 2007-03-22 · Updated 2018-10-16 · CVE-2007-1606

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions w-Agora (Web-Agora) (affected versions not specified)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected parameters include showuser in "profile.php", search forum or search user in "search.php", and userid in "change password.php".

Recommendations For all affected versions, consider disabling the parameters showuser, search forum, search user, and userid in their respective scripts until a fix is available. Restrict access to the scripts "profile.php", "search.php", and "change password.php" to minimize the risk of exploitation. Avoid using the parameters showuser, search forum, search user, and userid in the affected scripts until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-1606

Affected Products

W-Agora

References · 13

• 🔥 https://exploit-db.com/exploits/29764 · Exploit
• 🔥 https://exploit-db.com/exploits/29766 · Exploit
• 🔥 https://exploit-db.com/exploits/29765 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1606 · Security Note
• http://secunia.com/advisories/24605 · Vendor Advisory
• http://securityfocus.com/bid/23057 · Note
• http://osvdb.org/34378 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33175 · Note
• http://osvdb.org/34377 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1606 · Note
• http://securityfocus.com/archive/1/463286/100/0/threaded · Note
• http://securityreason.com/securityalert/2462 · Note
• http://osvdb.org/34379 · Note