logo

Database

Server side cross-site scripting In phpldapadmin

Description

Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dn parameter in (a) compare_form.php, (b) copy_form.php, (c) rename_form.php, (d) template_engine.php, and (e) delete_form.php; (2) scope parameter in (f) search.php; and (3) Container DN, (4) Machine Name, and (5) UID Number fields in (g) template_engine.php.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2006-20162. NVD-2006-20163. OSV-DEBIAN-2006-20164. OSV-2006-20165. SECURITY-TRACKER-CVE-2006-2016

References

1. https://www.exploit-db.com/exploits/277172. https://www.exploit-db.com/exploits/277183. https://www.exploit-db.com/exploits/277194. https://www.exploit-db.com/exploits/277215. https://www.exploit-db.com/exploits/27722

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.