PT-2006-3480 · Destiney · Destiney Rated Images Script

Luny · Publicado 2006-05-22 · Atualizado 2018-10-18 · CVE-2006-2533

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Destiney Rated Images Script version 0.5.0

Description The issue is related to a cross-site scripting (XSS) vulnerability. It affects the addWeblog.php and leaveComments.php files in the Destiney Rated Images Script. The vulnerability occurs because the software does not properly filter all vulnerable HTML tags, allowing remote attackers to inject arbitrary web script or HTML via Javascript in a DIV tag.

Recommendations For Destiney Rated Images Script version 0.5.0, consider disabling the addWeblog.php and leaveComments.php files until a patch is available to prevent the injection of arbitrary web script or HTML. Restrict access to these files to minimize the risk of exploitation. Avoid using Javascript in DIV tags in these files until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-2533

Produtos afetados

Destiney Rated Images Script

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/26605 · Nota
• http://securityfocus.com/bid/18070 · Nota
• http://secunia.com/advisories/20249 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2533 · Nota de Segurança
• http://securityfocus.com/archive/1/434691/100/0/threaded · Nota
• http://vupen.com/english/advisories/2006/1927 · Nota
• http://securityfocus.com/archive/1/435093/100/0/threaded · Nota
• http://securityreason.com/securityalert/940 · Nota