CVE-2006-1808: XSS
Cross-site scripting (XSS) vulnerability in index.php in Lifetype 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the show parameter in a Template operation.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to send a crafted request to index.php with malicious script or HTML in the show parameter during a Template operation. The issue is remotely reachable and does not require authentication, but exploitation has high attack complexity.
What is the likely impact if exploitation succeeds?
The vulnerability can allow injected script or HTML to run in the context of a user viewing the affected page. The provided severity data indicates an integrity impact, with no stated confidentiality or availability impact.
How can I identify potentially affected deployments?
Review LifeType installations for version 1.0.3 and inspect whether index.php processes the show parameter for Template operations. Requests containing unexpected HTML or script-like content in the show parameter may indicate attempted exploitation.