PT-2006-3513 · Alstrasoft · Alstrasoft Article Manager Pro

Luny · Publicado 2006-05-24 · Atualizado 2018-10-18 · CVE-2006-2567

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Alstrasoft Article Manager Pro version 1.6

Description The issue allows remote attackers to inject arbitrary web script or HTML when submitting an article. This can be achieved by using a javascript URI in a Cascading Style Sheets (CSS) property of a STYLE attribute of an element.

Recommendations For Alstrasoft Article Manager Pro version 1.6, consider validating and sanitizing user input in the submit article.php file to prevent the injection of malicious scripts or HTML. As a temporary workaround, restrict access to the submit article.php file until a proper fix is applied.

Correção

Identificadores relacionados

CVE-2006-2567

Produtos afetados

Alstrasoft Article Manager Pro

Referências · 6

• http://securityreason.com/securityalert/949 · Nota
• http://securityfocus.com/archive/1/434847/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2567 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26673 · Nota
• http://secunia.com/advisories/20228 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/1943 · Nota