PT-2007-6881 · Sf · Sf-Shoutbox

Published 2007-11-14 · Updated 2011-03-08 · CVE-2007-5948

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SF-Shoutbox versions 1.2.1 through 1.4

Description The issue allows remote attackers to inject arbitrary web script or HTML via the nick and shout parameters in the main.php file. This can be exploited by sending malicious input to the affected parameters.

Recommendations For SF-Shoutbox versions 1.2.1 through 1.4, consider validating and sanitizing user input for the nick and shout parameters to prevent arbitrary web script or HTML injection. As a temporary workaround, restrict access to the main.php file until a fix is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-5948

Affected Products

Sf-Shoutbox

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-5948 · Security Note
• http://secunia.com/advisories/27487 · Vendor Advisory
• http://osvdb.org/38401 · Note
• http://securityfocus.com/bid/26320 · Note
• http://vupen.com/english/advisories/2007/3722 · Note
• http://smash-the-stack.net/articles/SF-Shoutbox_Injection_Advisory.txt · Note