PT-2006-3197 · Agora · W-Agora

R0Xes · Publicado 2006-05-05 · Atualizado 2018-10-18 · CVE-2006-2228

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions w-Agora (aka Web-Agora) version 4.2.0

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a post with a BBCode tag. This is achieved by including a JavaScript event name followed by whitespace before the '=' character in the tag, which bypasses a restrictive regular expression intended to remove events like onmouseover.

Recommendations For w-Agora (aka Web-Agora) version 4.2.0, consider disabling the use of BBCode tags until a patch is available to prevent the exploitation of this issue. Restrict access to posts that may contain malicious scripts to minimize the risk of XSS attacks.

Exploit

Correção

Identificadores relacionados

CVE-2006-2228

Produtos afetados

W-Agora

Referências · 6

• 🔥 https://exploit-db.com/exploits/27783 · Exploit
• 🔥 http://securityfocus.com/bid/17751 · Exploit
• http://securityreason.com/securityalert/847 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2228 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2228 · Nota de Segurança
• http://securityfocus.com/archive/1/432457/100/0/threaded · Nota