CVE-2005-3496

Summary

Cross-site scripting (XSS) vulnerability in PHP Handicapper allows remote attackers to inject arbitrary web script or HTML via the msg parameter to msg.php. NOTE: some sources identify a second vector in the login parameter to process_signup.php, but the original source says that it is for CRLF injection (CVE-2005-4712). Also note: the vendor has disputed CVE-2005-3497, and it is possible that the dispute was intended to include this issue as well. If so, followup investigation strongly suggests that the original report is correct.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• http://www.osvdb.org/20479
• http://www.zone-h.org/advisories/read/id=8360
• http://www.securityfocus.com/bid/15294
• http://www.vupen.com/english/advisories/2005/2292
• http://secunia.com/advisories/17412
• http://www.osvdb.org/20480

References

• http://www.osvdb.org/20479
• http://www.zone-h.org/advisories/read/id=8360
• http://www.securityfocus.com/bid/15294
• http://www.vupen.com/english/advisories/2005/2292
• http://secunia.com/advisories/17412
• http://www.osvdb.org/20480

• ←Previous
• Next→