PT-2006-1476 · Pixelpost · Pixelpost Photoblog

Aliaksandr Hartsuyeu · Publicado 2006-01-25 · Atualizado 2018-10-19 · CVE-2006-0409

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pixelpost Photoblog version 1.4.3

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the Add Comment field in a comment popup. This occurs in the index.php file.

Recommendations For Pixelpost Photoblog version 1.4.3, consider disabling the comment popup feature until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the index.php file to minimize the risk of arbitrary web script or HTML injection. Avoid using the Add Comment field in the comment popup until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-0409

Produtos afetados

Pixelpost Photoblog

Referências · 10

• 🔥 https://exploit-db.com/exploits/27123 · Exploit
• 🔥 http://securityfocus.com/bid/16362 · Exploit
• 🔥 http://evuln.com/vulns/45/summary.html · Exploit
• http://securityfocus.com/archive/1/423384/100/0/threaded · Nota
• http://vupen.com/english/advisories/2006/0309 · Nota
• http://secunia.com/advisories/18572 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-0409 · Nota de Segurança
• http://securitytracker.com/id?1015529 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24261 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0409 · Nota