PT-2006-2806 · Tritanium · Tritanium Bulletin Board

D4Igoro · Published 2006-04-18 · Updated 2017-07-20 · CVE-2006-1815

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Tritanium Bulletin Board (TBB) version 1.2.3

Description The issue allows remote attackers to inject arbitrary web script or HTML via the newuser realname and newuser icq parameters in the register.php file. This is a different vector from a previously known issue.

Recommendations For version 1.2.3, avoid using the newuser realname and newuser icq parameters in the register.php file until the issue is resolved. As a temporary workaround, consider restricting access to the register.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2006-1815

Affected Products

Tritanium Bulletin Board

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-1815 · Security Note
• http://secunia.com/advisories/19635 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25751 · Note
• http://osvdb.org/24556 · Note
• http://vupen.com/english/advisories/2006/1329 · Note
• http://securityreason.com/securityalert/693 · Note