CVE-2006-2016 Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dn parameter in (a) compare_form.php, (b...
LowCVSS 2.6
EPSS 8.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dn parameter in (a) compare_form.php, (b) copy_form.php, (c) rename_form.php, (d) template_engine.php, and (e) delete_form.php; (2) scope parameter in (f) search.php; and (3) Container DN, (4) Machine Name, and (5) UID Number fields in (g) template_engine.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpldapadmin project phpldapadmin | <= 0.9.8 | No fix listed |
| debian linux | = 3.0 | No fix listed |
| debian linux | = 3.1 | No fix listed |
| debian/phpldapadmin(Debian:12) | < 0.9.8.3-1 | 0.9.8.3-1 |
| debian/phpldapadmin(Debian:13) | < 0.9.8.3-1 | 0.9.8.3-1 |
| debian/phpldapadmin(Debian:14) | < 0.9.8.3-1 | 0.9.8.3-1 |
References
- Debian Security Tracker CVE-2006-2016 vendor-advisory
- bugs.debian.org issue-tracking
- pridels0.blogspot.com third-party-advisory
- 19747 exploit third-party-advisory
- 20124 third-party-advisory
- DSA-1057 third-party-advisory vendor-advisory
- 24788 broken-link exploit vdb-entry
- 24789 broken-link exploit vdb-entry
- 24790 broken-link exploit vdb-entry
- 24792 broken-link exploit vdb-entry
- 24793 broken-link exploit vdb-entry
- 24794 broken-link exploit vdb-entry
- 17643 exploit third-party-advisory vdb-entry
- ADV-2006-1450 permissions-required vdb-entry
- phpldapadmin-scope-dn-xss(25958) third-party-advisory vdb-entry
- phpldapadmin-templateengine-xss(25959) third-party-advisory vdb-entry