Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in TorrentFlux 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) action, (2) file, and (3) users array variables in (a) admin.php, which are not properly handled when the administrator views the Activity Log; and the (4) torrent parameter, as used by the displayName variable, in (b) startpop.php, different vectors than CVE-2006-5227.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Torrentflux | Torrentflux | 2.1 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/22384Vendor Advisory
- http://www.securityfocus.com/archive/1/448619/100/100/threaded
- http://www.securityfocus.com/archive/1/448947/100/0/threaded
- http://www.securityfocus.com/archive/1/448948/100/0/threaded
- http://www.securityfocus.com/archive/1/448952/100/0/threaded
- http://www.securityfocus.com/bid/20534
- http://www.stevenroddis.com.au/2006/10/13/torrentflux-startpopphp-torrent-scriptExploit
- http://www.stevenroddis.com.au/2006/10/17/torrentflux-action-script-insertion/Exploit
- http://www.stevenroddis.com.au/2006/10/17/torrentflux-file-script-insertion/Exploit
- http://www.stevenroddis.com.au/2006/10/17/torrentflux-user_id-script-insertion/Exploit
- http://www.vupen.com/english/advisories/2006/4043Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29592
- http://secunia.com/advisories/22384Vendor Advisory
- http://www.securityfocus.com/archive/1/448619/100/100/threaded
- http://www.securityfocus.com/archive/1/448947/100/0/threaded
FAQ
What is CVE-2006-5451?
CVE-2006-5451 is a vulnerability with a CVSS score of 2.6 (LOW). Multiple cross-site scripting (XSS) vulnerabilities in TorrentFlux 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) action, (2) file, and (3) users array variables in (a) ...
How severe is CVE-2006-5451?
CVE-2006-5451 has been rated LOW with a CVSS base score of 2.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-5451?
Check the references section above for vendor advisories and patch information. Affected products include: Torrentflux Torrentflux.