PT-2006-2077 · Vbulletin · Vbulletin

Publicado 2006-03-07 · Atualizado 2018-10-18 · CVE-2006-1040

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions vBulletin versions 3.0.12 and 3.5.3

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the email field. This field is not properly sanitized when used in sendmsg.php, although it is injected in profile.php.

Recommendations For version 3.0.12, update the sendmsg.php file to properly sanitize the email field. For version 3.5.3, update the sendmsg.php file to properly sanitize the email field.

Exploit

Correção

Identificadores relacionados

CVE-2006-1040

Produtos afetados

Vbulletin

Referências · 11

• 🔥 http://kapda.ir/advisory-266.html · Exploit
• 🔥 https://exploit-db.com/exploits/27343 · Exploit
• http://vbulletin.com/forum/showthread.php?postid=1079030 · Nota
• http://osvdb.org/23614 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1040 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1040 · Nota de Segurança
• http://securityfocus.com/archive/1/426589/100/0/threaded · Nota
• http://secunia.com/advisories/19100 · Nota
• http://securityfocus.com/archive/1/426537/100/0/threaded · Nota
• http://securityfocus.com/bid/16919 · Nota
• http://vupen.com/english/advisories/2006/0808 · Nota