PT-2006-1229 · Simpbook · Simpbook

Published 2006-01-09 · Updated 2008-09-05 · CVE-2006-0149

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SimpBook version 1.0

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the message field when html enable is on, which is the default setting.

Recommendations For SimpBook version 1.0, consider disabling the html enable option to prevent exploitation of this issue. As a temporary workaround, restrict the use of the message field until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2006-0149

Affected Products

Simpbook

References · 3

• http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041127.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0149 · Security Note
• http://securitytracker.com/id?1015451 · Vendor Advisory