PT-2006-6693 · Eggblog · Eggblog

The_Edit0R · Publicado 2006-11-22 · Atualizado 2017-07-20 · CVE-2006-6046

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions eggblog version 3.1.0

Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible via the edit parameter to /admin/articles.php or /admin/comments.php, or the add parameter to /admin/users.php.

Recommendations For eggblog version 3.1.0, consider disabling the edit and add parameters in the affected API endpoints until a patch is available. Restrict access to /admin/articles.php, /admin/comments.php, and /admin/users.php to minimize the risk of exploitation. Avoid using the edit and add parameters in these endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2006-6046

Produtos afetados

Eggblog

Referências · 5

• 🔥 http://securityfocus.com/bid/21134 · Exploit
• 🔥 http://securitytracker.com/id?1017246 · Exploit
• http://marc.info/?l=bugtraq&m=116373125308955&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6046 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30351 · Nota