PHP Arena paFileDB Cross-Site Scripting Vulnerability

vendor:

paFileDB

by:

SecurityFocus

3.3

CVSS

MEDIUM

Cross-Site Scripting

CWE

Product Name: paFileDB

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

PHP Arena paFileDB Cross-Site Scripting Vulnerability

PHP Arena paFileDB is prone to cross-site scripting attacks. An attacker may construct a malicious link to the vulnerable script which contains arbitrary HTML and script code. If this link is visited by a web user, the attacker-supplied code will execute in their web client in the security context of the paFileDB site. This issue is in the 'Email to Friend' function of the paFileDB script.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized before being used in the application.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/6018/info

PHP Arena paFileDB is prone to cross-site scripting attacks.

An attacker may construct a malicious link to the vulnerable script which contains arbitrary HTML and script code. If this link is visited by a web user, the attacker-supplied code will execute in their web client in the security context of the paFileDB site.

This issue is in the "Email to Friend" function of the paFileDB script. 

http://www.example.com/downloads/pafiledb.php?action=email&id=4?"<script>alert('Testing')</script>" 

http://www.example.com/downloads/pafiledb.php?action=rate&id=4?"&lt;script&gt;alert('Testing')&lt;/script&gt;" 

http://www.example.com/downloads/pafiledb.php?action=download&id=4?"&lt;script&gt;alert('Testing')&lt;/script&gt;"