Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2006-1642

Overview

Vulnerability Score 2.6 2.6
CVE Id CVE-2006-1642
Last Modified 07 Mar 2011 09:33:28
Published 06 Apr 2006 06:04:00
Confidentiality Impact NONE NONE
Integrity Impact PARTIAL PARTIAL
Availability Impact NONE NONE
Access Vector NETWORK
Access Complexity HIGH
Authentication NONE

CVE-2006-1642

Summary

Cross-site scripting (XSS) vulnerability in Interact 2.1.1 allows remote attackers to inject arbitrary web script or HTML via (1) the search_terms parameter to (a) search.php, and (2) the first_name, (3) last_name, (4) email, (5) password, and (6) confirm_password parameters to (b) userinput.php. NOTE: the provenance of this information is unknown; the details are obtained from third party. In addition, the lack of precision in the third party descriptions makes it unclear whether the named vectors are correct.

Vulnerable Systems

Application

  • Interact 1.8.7

  • Interact 1.9

  • Interact 1.9.1

  • Interact 2.0

  • Interact 2.1

  • Interact 2.1.1


References

VUPEN - ADV-2006-1244

SECUNIA - 19488

XF - interact-search-xss(25652)

OSVDB - 24461

OSVDB - 24389


Last Updated: 27 May 2016 10:42:09