PT-2006-3730 · Dominios Europa · Dominios Europa Picrate

Luny · Published 2006-06-05 · Updated 2018-10-18 · CVE-2006-2812

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dominios Europa PICRATE (aka TAL RateMyPic) version 1.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the name (aka nick), email, and comment boxes; and via the id parameter. This can be exploited through specific API endpoints, although the exact endpoints are not specified.

Recommendations For Dominios Europa PICRATE (aka TAL RateMyPic) version 1.0, consider disabling the comment and user input features until a patch is available to prevent exploitation through the name, email, and comment boxes, as well as the id parameter. Restrict access to user-provided input to minimize the risk of arbitrary web script or HTML injection.

Fix

Related Identifiers

CVE-2006-2812

Affected Products

Dominios Europa Picrate

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2006-2812 · Security Note
• http://securityreason.com/securityalert/1032 · Note
• http://securityfocus.com/archive/1/435599/100/0/threaded · Note