PT-2006-1432 · Bit 5 · Bit 5 Blog

Aliaksandr Hartsuyeu · Publicado 2006-01-22 · Atualizado 2018-10-19 · CVE-2006-0361

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Bit 5 Blog version 8.01

Description A cross-site scripting issue exists due to insufficient input validation in the comment parameter of the addcomment.php file. This allows remote attackers to inject arbitrary web script or HTML via a javascript URI in an tag. The issue arises because the system strips most tags but fails to strip the tag, enabling the injection of malicious code.

Recommendations For Bit 5 Blog version 8.01, consider validating and sanitizing user input in the comment parameter to prevent the injection of malicious code, specifically focusing on proper handling of tags and javascript URIs. As a temporary workaround, restrict the use of the comment feature in addcomment.php until a proper fix is implemented.

Exploit

Correção

Identificadores relacionados

CVE-2006-0361

Produtos afetados

Bit 5 Blog

Referências · 10

• 🔥 https://exploit-db.com/exploits/27085 · Exploit
• 🔥 http://securityfocus.com/bid/16246 · Exploit
• 🔥 http://secunia.com/advisories/18464 · Exploit
• 🔥 http://evuln.com/vulns/32/exploit · Exploit
• 🔥 http://evuln.com/vulns/32/summary · Exploit
• http://securityfocus.com/archive/1/421994/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0361 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24129 · Nota
• http://osvdb.org/22446 · Nota
• http://vupen.com/english/advisories/2006/0195 · Nota