PT-2006-2806 · Tritanium · Tritanium Bulletin Board

D4Igoro · Publicado 2006-04-18 · Atualizado 2017-07-20 · CVE-2006-1815

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Tritanium Bulletin Board (TBB) version 1.2.3

Description The issue allows remote attackers to inject arbitrary web script or HTML via the newuser realname and newuser icq parameters in the register.php file. This is a different vector from a previously known issue.

Recommendations For version 1.2.3, avoid using the newuser realname and newuser icq parameters in the register.php file until the issue is resolved. As a temporary workaround, consider restricting access to the register.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2006-1815

Produtos afetados

Tritanium Bulletin Board

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/25751 · Nota
• http://osvdb.org/24556 · Nota
• http://vupen.com/english/advisories/2006/1329 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1815 · Nota de Segurança
• http://securityreason.com/securityalert/693 · Nota
• http://secunia.com/advisories/19635 · Aviso do Fabricante