PT-2006-1849 · Postnuke · Postnuke

Maksymilian Arciemowicz

·

Publicado

2006-02-20

·

Atualizado

2017-07-20

·

CVE-2006-0800

CVSS v2.0

2.6

Baixa

VetorAV:N/AC:H/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions PostNuke versions 0.761 and earlier
Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character. This character is interpreted as a ">" character by some web browsers but bypasses the blacklist protection in certain functions, including the pnVarCleanFromInput function in pnAPI.php, the pnSecureInput function in pnAntiCracker.php, and the htmltext parameter in an edituser operation to user.php.
Recommendations For PostNuke versions 0.761 and earlier, consider disabling the pnVarCleanFromInput function, the pnSecureInput function, and restricting access to the htmltext parameter in the edituser operation to user.php until a patch is available. Avoid using HTML tags with a trailing "<" character in the affected functions and parameters to minimize the risk of exploitation.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2006-0800

Produtos afetados

Postnuke