6.8

CVE-2005-4317

Exploit
Limbo CMS 1.0.4.2 and earlier, with register_globals off, does not protect the $_SERVER variable from external modification, which allows remote attackers to use the _SERVER[REMOTE_ADDR] parameter to (1) conduct cross-site scripting (XSS) attacks in the stats module or (2) execute arbitrary code via an eval injection attack in the wrapper option in index2.php.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Limbo Cms ≫ Limbo Cms Version <= 1.0.4.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.25% 0.915
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://rgod.altervista.org/limbo1042_xpl.html
Vendor Advisory
Exploit
http://secunia.com/advisories/18063/
Patch
Vendor Advisory
http://securityreason.com/securityalert/255
http://securitytracker.com/id?1015364
Exploit
http://www.osvdb.org/21754
http://www.osvdb.org/21756
http://www.securityfocus.com/archive/1/419470/100/0/threaded
http://www.securityfocus.com/bid/15871/
Exploit
http://www.vupen.com/english/advisories/2005/2932