CVE-2006-6197

EPSS 1.8%

Multiple cross-site scripting (XSS) vulnerabilities in b2evolution 1.8.2 through 1.9 beta allow remote attackers to inject arbitrary web script or HTML via the (1) app_name parameter in (a) _404_not_found.page.php, (b) _410_stats_gone.page.php, and (c) _referer_spam.page.php in inc/VIEW/errors/; the (2) baseurl parameter in (d) inc/VIEW/errors/_404_not_found.page.php; and the (3) ReqURI parameter in (e) inc/VIEW/errors/_referer_spam.page.php.

Affected products

n/a · n/a

public PoCs found — 3

exploitdbwww.exploit-db.com/exploits/29198unverified exploitdbwww.exploit-db.com/exploits/29199unverified exploitdbwww.exploit-db.com/exploits/29200unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://secunia.com/advisories/23148 http://securityreason.com/securityalert/1944 https://exchange.xforce.ibmcloud.com/vulnerabilities/30562 http://www.securityfocus.com/archive/1/452895/100/0/threaded http://www.securityfocus.com/bid/21334