PHP GEN Unspecified Cross-Site Scripting Vulnerabilities

Bugtraq ID:	15458
Class:	Input Validation Error
CVE:	CVE-2006-0497
Remote:	Yes
Local:	No
Published:	May 20 2005 12:00AM
Updated:	Feb 07 2006 08:56PM
Credit:	These issues were announced by the vendor.
Vulnerable:	PHP GEN PHP GEN 1.3
Not Vulnerable:	PHP GEN PHP GEN 1.4

PHP GEN Unspecified Cross-Site Scripting Vulnerabilities

PHP GEN is prone to unspecified cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

PHP GEN Unspecified Cross-Site Scripting Vulnerabilities

No exploit is required.

PHP GEN Unspecified Cross-Site Scripting Vulnerabilities

Solution:

The vendor has addressed this issue in PHP GEN version 1.3 and in PHP GEN version 1.4. Please see the reference section for further details.


PHP GEN PHP GEN 1.3

• PHP GEN php_gen-1.4.tgz
  http://www.eyce.be/php_gen/downloads/php_gen-1.4.tgz

PHP GEN Unspecified Cross-Site Scripting Vulnerabilities

References:

• PHP GEN Changelog (PHP GEN)
  
• PHP GEN Homepage (PHP GEN)