PT-2005-4073 · Unknown · Versatilebulletinboard

Rgod · Published 2005-10-20 · Updated 2016-10-18 · CVE-2005-3260

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions versatileBulletinBoard (vBB) version 1.0.0 RC2

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via two parameters: the url parameter in "dereferrer.php" and the file parameter in "imagewin.php".

Recommendations For version 1.0.0 RC2, consider disabling the dereferrer.php and imagewin.php scripts until a patch is available to prevent exploitation. Restrict access to these scripts to minimize the risk of arbitrary web script or HTML injection. Avoid using the url and file parameters in the affected scripts until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-3260

Affected Products

Versatilebulletinboard

References · 8

• 🔥 http://securityfocus.com/bid/15073 · Exploit
• 🔥 http://rgod.altervista.org/versatile100RC2.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-3260 · Security Note
• http://secunia.com/advisories/17174 · Vendor Advisory
• http://osvdb.org/19970 · Note
• http://marc.info/?l=bugtraq&m=112907535528616&w=2 · Note
• http://osvdb.org/19971 · Note
• http://osvdb.org/19969 · Note