PT-2006-4369 · Buddy Zone · Buddy Zone

Luny · Publicado 2006-07-10 · Atualizado 2018-10-18 · CVE-2006-3494

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Buddy Zone version 1.0.1

Description The issue allows remote attackers to inject arbitrary HTML and web script. This can be achieved via several parameters, including the cat id parameter to "view classifieds.php", the id parameter in "view ad.php", the event id parameter in "view event.php", "delete event.php", and "edit event.php", and the group id in "view group.php".

Recommendations For Buddy Zone version 1.0.1, consider restricting access to the vulnerable parameters cat id, id, event id, and group id in the respective API endpoints until a patch is available. As a temporary workaround, avoid using these parameters in the affected endpoints.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2006-3494

Produtos afetados

Buddy Zone

Referências · 22

• 🔥 http://osvdb.org/26979 · Exploit
• 🔥 http://osvdb.org/26984 · Exploit
• 🔥 http://osvdb.org/26983 · Exploit
• 🔥 http://osvdb.org/26982 · Exploit
• 🔥 http://osvdb.org/26985 · Exploit
• 🔥 http://osvdb.org/26981 · Exploit
• 🔥 http://osvdb.org/26980 · Exploit
• http://secunia.com/advisories/20933 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27514 · Nota
• http://osvdb.org/26993 · Nota
• http://securityfocus.com/archive/1/438868/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3494 · Nota
• http://osvdb.org/26992 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3494 · Nota de Segurança
• http://osvdb.org/26990 · Nota