PT-2006-2046 · N8Cms · N8Cms

Liz0 · Published 2006-03-06 · Updated 2018-10-18 · CVE-2006-1008

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions N8cms versions 1.1 through 1.2

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially resulting from SQL injection. This can be achieved via the dir and page id parameters to "index.php" and the userid parameter to "mailto.php".

Recommendations For versions 1.1 and 1.2, consider restricting access to the index.php and mailto.php files until a patch is available. As a temporary workaround, avoid using the dir, page id, and userid parameters in the affected API endpoints.

Exploit

Fix

Related Identifiers

CVE-2006-1008

Affected Products

N8Cms

References · 11

• 🔥 http://biyosecurity.be/bugs/n8cms.txt · Exploit
• 🔥 https://exploit-db.com/exploits/27331 · Exploit
• 🔥 https://exploit-db.com/exploits/27332 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1008 · Security Note
• http://secunia.com/advisories/19068 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25126 · Note
• http://securityfocus.com/archive/1/427222/100/0/threaded · Note
• http://securityfocus.com/bid/16858 · Note
• http://securityreason.com/securityalert/562 · Note
• http://vupen.com/english/advisories/2006/0779 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24975 · Note