PT-2008-3760 · Mjguest · Mjguest

Dr.Crash + 1 · Published 2008-05-16 · Updated 2018-10-11 · CVE-2008-2268

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Mjguest version 6.7 GT Rev.01

Description: The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the goto parameter in a redirect action to "mjguest.php". The attack is user-assisted, meaning there is a delay and a notification before the redirection occurs.

Recommendations: For Mjguest version 6.7 GT Rev.01, consider restricting access to the "interface/redirect.htm.php" file or avoiding the use of the goto parameter in redirect actions to "mjguest.php" until a fix is available. As a temporary workaround, consider implementing additional validation for the goto parameter to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2008-2268

Affected Products

Mjguest

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-2268 · Security Note
• http://securityfocus.com/archive/1/492384/100/0/threaded · Note
• http://mdsjack.bo.it/public/phpBB3/viewtopic.php?t=2049 · Note
• http://securityreason.com/securityalert/3872 · Note
• http://securityfocus.com/archive/1/491523/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42130 · Note