PT-2007-1193 · Dt · Dm Guestbook

Jesper Jurcenoks · Publicado 2007-01-16 · Atualizado 2018-10-17 · CVE-2006-6487

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: DT Guestbook version 1.0f

Description: A cross-site scripting issue exists due to the lack of proper input validation in the index.php file of DT Guestbook. When the register globals setting is enabled, remote attackers can inject arbitrary web script or HTML via the error[] parameter.

Recommendations: For DT Guestbook version 1.0f, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the index.php file until a proper fix is applied, and avoid using the error[] parameter in sensitive operations.

Exploit

Correção

Identificadores relacionados

CVE-2006-6487

Produtos afetados

Dm Guestbook

Referências · 9

• 🔥 http://netvigilance.com/advisory0010 · Exploit
• 🔥 https://exploit-db.com/exploits/29472 · Exploit
• 🔥 http://osvdb.org/30787 · Exploit
• 🔥 http://secunia.com/advisories/23778 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31518 · Nota
• http://securityfocus.com/bid/22078 · Nota
• http://vupen.com/english/advisories/2007/0205 · Nota
• http://securityfocus.com/archive/1/457059/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6487 · Nota de Segurança