PT-2006-3197 · Agora · W-Agora

R0Xes · Published 2006-05-05 · Updated 2018-10-18 · CVE-2006-2228

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions w-Agora (aka Web-Agora) version 4.2.0

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a post with a BBCode tag. This is achieved by including a JavaScript event name followed by whitespace before the '=' character in the tag, which bypasses a restrictive regular expression intended to remove events like onmouseover.

Recommendations For w-Agora (aka Web-Agora) version 4.2.0, consider disabling the use of BBCode tags until a patch is available to prevent the exploitation of this issue. Restrict access to posts that may contain malicious scripts to minimize the risk of XSS attacks.

Exploit

Fix

Related Identifiers

CVE-2006-2228

Affected Products

W-Agora

References · 6

• 🔥 https://exploit-db.com/exploits/27783 · Exploit
• 🔥 http://securityfocus.com/bid/17751 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2228 · Security Note
• http://securityreason.com/securityalert/847 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2228 · Note
• http://securityfocus.com/archive/1/432457/100/0/threaded · Note