CVE-2006-5984 Cross-site scripting in n/a

Medium 6.8 Published 20 Nov 2006 Updated 7 Aug 2024

Authenticated users can inject arbitrary scripts via specific parameters in Helm Web Hosting Control Panel, potentially leading to session hijacking or data theft.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2006-5984?

CVE-2006-5984 is a medium-severity cross-site scripting vulnerability in n/a, published on 20 Nov 2006. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) txtCompanyName, (2) txtEmail, or (3) txtUserAccNum parameter to (a) users.asp, or the (4) setThemeColour parameter to (b) default.asp in the Reseller and Admin levels; or the (5) setThemeColour parameter to default.asp in the User level. NOTE: the txtDomainName parameter to domains.asp is covered by CVE-2006-1407, which suggests that this vector is fixed in 3.2.10 stable.

Which versions are affected by CVE-2006-5984?

It affects 1 product.

Products include Webhost Automation Helm Web Hosting Control Panel.

How do I fix CVE-2006-5984?

No fix has been published for CVE-2006-5984 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2006-5984 being exploited?

There is no known exploitation of CVE-2006-5984 in the wild and no public exploit code.

Sources

Also known as GHSA-78w9-8p3h-w2r9.