PT-2006-5974 · Expblog · Expblog

Tamriel · Publicado 2006-10-12 · Atualizado 2018-10-17 · CVE-2006-5239

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions eXpBlog versions 0.3.5 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible via the query string (PHP SELF) in "kalender.php" or the captcha session code parameter in "pre details.php".

Recommendations For versions 0.3.5 and earlier, consider disabling the kalender.php and pre details.php scripts until a patch is available. Restrict access to these scripts to minimize the risk of exploitation. Avoid using the captcha session code parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2006-5239

Produtos afetados

Expblog

Referências · 10

• 🔥 https://exploit-db.com/exploits/28776 · Exploit
• 🔥 http://securityfocus.com/bid/20420 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5239 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29409 · Nota
• http://secunia.com/advisories/22328 · Aviso do Fabricante
• http://securitytracker.com/id?1017028 · Nota
• http://vupen.com/english/advisories/2006/3973 · Aviso do Fabricante
• http://expblog.de/board/viewtopic.php?t=317 · Correção
• http://securityfocus.com/archive/1/448102/100/0/threaded · Nota
• http://marc.info/?l=full-disclosure&m=116042862409660&w=2 · Nota