PT-2006-1476 · Pixelpost · Pixelpost Photoblog

Aliaksandr Hartsuyeu · Published 2006-01-25 · Updated 2018-10-19 · CVE-2006-0409

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pixelpost Photoblog version 1.4.3

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the Add Comment field in a comment popup. This occurs in the index.php file.

Recommendations For Pixelpost Photoblog version 1.4.3, consider disabling the comment popup feature until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the index.php file to minimize the risk of arbitrary web script or HTML injection. Avoid using the Add Comment field in the comment popup until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-0409

Affected Products

Pixelpost Photoblog

References · 10

• 🔥 https://exploit-db.com/exploits/27123 · Exploit
• 🔥 http://securityfocus.com/bid/16362 · Exploit
• 🔥 http://evuln.com/vulns/45/summary.html · Exploit
• http://secunia.com/advisories/18572 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0409 · Security Note
• http://securityfocus.com/archive/1/423384/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/0309 · Note
• http://securitytracker.com/id?1015529 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24261 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0409 · Note