PT-2006-6470 · Elog · Elog

Ulf Harnhammar · Published 2006-11-07 · Updated 2017-07-20 · CVE-2006-5791

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: ELOG versions 2.6.2 and earlier

Description: The issue allows remote attackers to inject arbitrary HTML or web script via specific parameters. This can be achieved by injecting malicious input in the filename for downloading, which is not properly quoted in an error message by the send file direct function. Additionally, the Type or Category values in a New entry are not properly handled in an error message by the submit elog function, allowing for the injection of arbitrary web script.

Recommendations: For ELOG versions 2.6.2 and earlier, consider disabling the send file direct and submit elog functions until a patch is available to prevent exploitation. Restrict access to error messages that may contain user-inputted data to minimize the risk of arbitrary HTML or web script injection.

Fix

Related Identifiers

CVE-2006-5791

DSA-1242-1

Affected Products

Elog

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2006-5791 · Security Note
• http://secunia.com/advisories/22638 · Vendor Advisory
• http://debian.org/security/2006/dsa-1242 · Vendor Advisory
• http://securityfocus.com/bid/20882 · Note
• http://vupen.com/english/advisories/2006/4315 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=392016 · Note
• http://securityfocus.com/bid/20881 · Note
• http://secunia.com/advisories/23580 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29986 · Note