PT-2007-1193 · Dt · Dm Guestbook

Jesper Jurcenoks · Published 2007-01-16 · Updated 2018-10-17 · CVE-2006-6487

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: DT Guestbook version 1.0f

Description: A cross-site scripting issue exists due to the lack of proper input validation in the index.php file of DT Guestbook. When the register globals setting is enabled, remote attackers can inject arbitrary web script or HTML via the error[] parameter.

Recommendations: For DT Guestbook version 1.0f, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the index.php file until a proper fix is applied, and avoid using the error[] parameter in sensitive operations.

Exploit

Fix

Related Identifiers

CVE-2006-6487

Affected Products

Dm Guestbook

References · 9

• 🔥 http://netvigilance.com/advisory0010 · Exploit
• 🔥 https://exploit-db.com/exploits/29472 · Exploit
• 🔥 http://osvdb.org/30787 · Exploit
• 🔥 http://secunia.com/advisories/23778 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6487 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31518 · Note
• http://securityfocus.com/bid/22078 · Note
• http://vupen.com/english/advisories/2007/0205 · Note
• http://securityfocus.com/archive/1/457059/100/0/threaded · Note