PT-2006-2070 · Dragonfly · Dragonfly Cms

Lostmon · Publicado 2006-03-07 · Atualizado 2017-07-20 · CVE-2006-1033

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Dragonfly CMS versions prior to 9.0.6.1

Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters in different modules, including the Your Account, News, Stories Archive, Web Links, Surveys, Downloads, and coppermine modules, as well as the search box in several modules. The vulnerable parameters include uname, error, profile, username, catid, sid, Story Text, Extended text, month, year, sa, show, cid, ratetype, orderby, op, pollid, c, meta, and album.

Recommendations For Dragonfly CMS versions prior to 9.0.6.1, update to version 9.0.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable modules and parameters until a patch is applied. Avoid using the vulnerable parameters in the affected modules until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-1033

Produtos afetados

Dragonfly Cms

Referências · 14

• 🔥 https://exploit-db.com/exploits/27267 · Exploit
• 🔥 http://securitytracker.com/id?1015661 · Exploit
• 🔥 https://exploit-db.com/exploits/27263 · Exploit
• 🔥 https://exploit-db.com/exploits/27266 · Exploit
• 🔥 https://exploit-db.com/exploits/27265 · Exploit
• 🔥 http://securityfocus.com/bid/16784 · Exploit
• 🔥 https://exploit-db.com/exploits/27269 · Exploit
• 🔥 http://lostmon.blogspot.com/2006/02/multiple-cross-site-scripting-in.html · Exploit
• 🔥 https://exploit-db.com/exploits/27268 · Exploit
• 🔥 https://exploit-db.com/exploits/27264 · Exploit
• http://secunia.com/advisories/18940 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-1033 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24843 · Nota
• http://vupen.com/english/advisories/2006/0688 · Nota