PAFileDB ID Variable Cross-Site Scripting Vulnerability

Bugtraq ID:	10229
Class:	Input Validation Error
CVE:	CVE-2004-1975
Remote:	Yes
Local:	No
Published:	Apr 28 2004 12:00AM
Updated:	Nov 08 2006 09:22PM
Credit:	Discovered by DarkBicho <[email protected]>.
Vulnerable:	PHP Arena paFileDB 3.1 PHP Arena paFileDB 3.0 Beta 3.1 PHP Arena paFileDB 3.0 PHP Arena paFileDB 2.1.1 PHP Arena paFileDB 1.1.3
Not Vulnerable:

PAFileDB ID Variable Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability has been reported in paFileDB.

An attacker may construct a malicious link to this web application containing embedded arbitrary HTML and script code. If a vistim user follows the link, the attacker may be able to steal cookie-based authentication credentials or launch other attacks.

This issue is reported to reside in version 3.x; other versions may be affected as well.

PAFileDB ID Variable Cross-Site Scripting Vulnerability

No exploit code is required.

PAFileDB ID Variable Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

PAFileDB ID Variable Cross-Site Scripting Vulnerability

References:

• paFileDB Homepage (PHP Arena)
  
• Multiple vulnerabilities paFileDB ("k1LL3r B0y" )
  
• XSS IN paFileDB 3.1 ([email protected])