Description
Cross-site scripting (XSS) vulnerability in index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action. NOTE: it was later reported that 5.2.1 is also affected.
Affected products
- avatic / aardvark_topsites_php5.2.0
- avatic / aardvark_topsites_php4.0.2 – 4.0.2
- avatic / aardvark_topsites_php4.1.1 – 4.1.1
- avatic / aardvark_topsites_php4.2.2 – 4.2.2
- avatic / aardvark_topsites_php5 – 5
- avatic / aardvark_topsites_php5.0.3 – 5.0.3
- avatic / aardvark_topsites_php5.1.2 – 5.1.2
References
- MISChttp://www.securityfocus.com/bid/35506
- MISChttp://www.securityfocus.com/archive/1/504574/100/0/threaded
- VENDOR_ADVISORYhttp://secunia.com/advisories/41985
- MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/51391
- MISChttp://www.securityfocus.com/archive/1/514423/100/0/threaded
- MISChttp://websec.id3as.com/aardvark-topsites-php-521-security-vulnerabilities-disclosure/