PT-2006-3513 · Alstrasoft · Alstrasoft Article Manager Pro

Luny · Published 2006-05-24 · Updated 2018-10-18 · CVE-2006-2567

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Alstrasoft Article Manager Pro version 1.6

Description The issue allows remote attackers to inject arbitrary web script or HTML when submitting an article. This can be achieved by using a javascript URI in a Cascading Style Sheets (CSS) property of a STYLE attribute of an element.

Recommendations For Alstrasoft Article Manager Pro version 1.6, consider validating and sanitizing user input in the submit article.php file to prevent the injection of malicious scripts or HTML. As a temporary workaround, restrict access to the submit article.php file until a proper fix is applied.

Fix

Related Identifiers

CVE-2006-2567

Affected Products

Alstrasoft Article Manager Pro

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-2567 · Security Note
• http://secunia.com/advisories/20228 · Vendor Advisory
• http://securityreason.com/securityalert/949 · Note
• http://securityfocus.com/archive/1/434847/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26673 · Note
• http://vupen.com/english/advisories/2006/1943 · Note