PT-2006-1432 · Bit 5 · Bit 5 Blog

Aliaksandr Hartsuyeu · Published 2006-01-22 · Updated 2018-10-19 · CVE-2006-0361

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Bit 5 Blog version 8.01

Description A cross-site scripting issue exists due to insufficient input validation in the comment parameter of the addcomment.php file. This allows remote attackers to inject arbitrary web script or HTML via a javascript URI in an tag. The issue arises because the system strips most tags but fails to strip the tag, enabling the injection of malicious code.

Recommendations For Bit 5 Blog version 8.01, consider validating and sanitizing user input in the comment parameter to prevent the injection of malicious code, specifically focusing on proper handling of tags and javascript URIs. As a temporary workaround, restrict the use of the comment feature in addcomment.php until a proper fix is implemented.

Exploit

Fix

Related Identifiers

CVE-2006-0361

Affected Products

Bit 5 Blog

References · 10

• 🔥 https://exploit-db.com/exploits/27085 · Exploit
• 🔥 http://securityfocus.com/bid/16246 · Exploit
• 🔥 http://secunia.com/advisories/18464 · Exploit
• 🔥 http://evuln.com/vulns/32/exploit · Exploit
• 🔥 http://evuln.com/vulns/32/summary · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0361 · Security Note
• http://securityfocus.com/archive/1/421994/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24129 · Note
• http://osvdb.org/22446 · Note
• http://vupen.com/english/advisories/2006/0195 · Note