PT-2006-3480 · Destiney · Destiney Rated Images Script

Luny · Published 2006-05-22 · Updated 2018-10-18 · CVE-2006-2533

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Destiney Rated Images Script version 0.5.0

Description The issue is related to a cross-site scripting (XSS) vulnerability. It affects the addWeblog.php and leaveComments.php files in the Destiney Rated Images Script. The vulnerability occurs because the software does not properly filter all vulnerable HTML tags, allowing remote attackers to inject arbitrary web script or HTML via Javascript in a DIV tag.

Recommendations For Destiney Rated Images Script version 0.5.0, consider disabling the addWeblog.php and leaveComments.php files until a patch is available to prevent the injection of arbitrary web script or HTML. Restrict access to these files to minimize the risk of exploitation. Avoid using Javascript in DIV tags in these files until the issue is resolved.

Fix

Related Identifiers

CVE-2006-2533

Affected Products

Destiney Rated Images Script

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-2533 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26605 · Note
• http://securityfocus.com/bid/18070 · Note
• http://secunia.com/advisories/20249 · Note
• http://securityfocus.com/archive/1/434691/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/1927 · Note
• http://securityfocus.com/archive/1/435093/100/0/threaded · Note
• http://securityreason.com/securityalert/940 · Note