PT-2007-7294 · Anon · Anon Proxy Server

Published 2007-12-20 · Updated 2008-09-05 · CVE-2007-6460

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Anon Proxy Server versions prior to 0.101

Description The issue allows remote attackers to inject arbitrary web script or HTML via the URI. This is later displayed by log.php or logerror.php, enabling the execution of malicious scripts.

Recommendations For versions prior to 0.101, update to version 0.101 or later to resolve the issue. As a temporary workaround, consider restricting access to log.php and logerror.php to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-6460

Affected Products

Anon Proxy Server

References · 5

• 🔥 http://anonproxyserver.svn.sourceforge.net/viewvc/anonproxyserver/trunk/anon_proxy_server/log.php?r1=284&r2=325 · Exploit
• 🔥 http://anonproxyserver.svn.sourceforge.net/viewvc/anonproxyserver/trunk/anon_proxy_server/logerror.php?r1=245&r2=325 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6460 · Security Note
• http://sourceforge.net/forum/forum.php?forum_id=761265 · Note
• http://anonproxyserver.svn.sourceforge.net/viewvc/anonproxyserver/trunk/anon_proxy_server · Note