PT-2006-6693 · Eggblog · Eggblog

The_Edit0R · Published 2006-11-22 · Updated 2017-07-20 · CVE-2006-6046

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions eggblog version 3.1.0

Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible via the edit parameter to /admin/articles.php or /admin/comments.php, or the add parameter to /admin/users.php.

Recommendations For eggblog version 3.1.0, consider disabling the edit and add parameters in the affected API endpoints until a patch is available. Restrict access to /admin/articles.php, /admin/comments.php, and /admin/users.php to minimize the risk of exploitation. Avoid using the edit and add parameters in these endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2006-6046

Affected Products

Eggblog

References · 5

• 🔥 http://securityfocus.com/bid/21134 · Exploit
• 🔥 http://securitytracker.com/id?1017246 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6046 · Security Note
• http://marc.info/?l=bugtraq&m=116373125308955&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30351 · Note