CVE-2008-3937

Name of the Vulnerable Software and Affected Versions OpenDb version 1.0.6

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the user id parameter in an edit action to "user admin.php", the title parameter to "listings.php", and the redirect url parameter to "user profile.php".

Recommendations For OpenDb version 1.0.6, avoid using the user id parameter in the edit action to "user admin.php", the title parameter to "listings.php", and the redirect url parameter to "user profile.php" until a fix is available. Consider restricting access to these parameters to minimize the risk of exploitation.