PT-2005-4073 · Unknown · Versatilebulletinboard

Rgod · Publicado 2005-10-20 · Atualizado 2016-10-18 · CVE-2005-3260

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions versatileBulletinBoard (vBB) version 1.0.0 RC2

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via two parameters: the url parameter in "dereferrer.php" and the file parameter in "imagewin.php".

Recommendations For version 1.0.0 RC2, consider disabling the dereferrer.php and imagewin.php scripts until a patch is available to prevent exploitation. Restrict access to these scripts to minimize the risk of arbitrary web script or HTML injection. Avoid using the url and file parameters in the affected scripts until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-3260

Produtos afetados

Versatilebulletinboard

Referências · 8

• 🔥 http://securityfocus.com/bid/15073 · Exploit
• 🔥 http://rgod.altervista.org/versatile100RC2.html · Exploit
• http://osvdb.org/19970 · Nota
• http://marc.info/?l=bugtraq&m=112907535528616&w=2 · Nota
• http://osvdb.org/19971 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3260 · Nota de Segurança
• http://osvdb.org/19969 · Nota
• http://secunia.com/advisories/17174 · Aviso do Fabricante