| CVE-2006-2227 |
|
发布时间 :2006-05-05 15:02:00 | ||
| 修订时间 :2011-03-07 21:35:34 | ||||
| NMCO |
[原文]Cross-site scripting (XSS) vulnerability in misc.php in PunBB 1.2.11 allows remote attackers to inject arbitrary web script or HTML via the req_message parameter, because the value of the redirect_url parameter is not sanitized.
[CNNVD]PunBB misc.php 跨站脚本攻击(XSS) 漏洞(CNNVD-200605-105)
PunBB 1.2.11的misc.php 存在跨站脚本攻击(XSS) 漏洞。远程攻击者可以借助req_message参数注入任意Web脚本或HTML，因为redirect_url 参数未清理。
- CVSS (基础分值)
| CVSS分值: | 4.3 | [中等(MEDIUM)] |
| 机密性影响: | NONE | [对系统的机密性无影响] |
| 完整性影响: | PARTIAL | [可能会导致系统文件被修改] |
| 可用性影响: | NONE | [对系统可用性无影响] |
| 攻击复杂度: | MEDIUM | [漏洞利用存在一定的访问条件] |
| 攻击向量: | [--] | |
| 身份认证: | NONE | [漏洞利用无需身份认证] |
- CPE (受影响的平台与产品)
| 产品及版本信息(CPE)暂不可用 |
- OVAL (用于检测的技术细节)
| 未找到相关OVAL定义 |
- 官方数据库链接
- 其它链接及资源
|
http://www.vupen.com/english/advisories/2006/1670 (UNKNOWN) VUPEN ADV-2006-1670 |
|
http://www.securityfocus.com/archive/1/archive/1/432950/100/0/threaded (UNKNOWN) BUGTRAQ 20060503 PunBB1.2.11 Cross-Site Scripting |
|
http://secunia.com/advisories/19986 (VENDOR_ADVISORY) SECUNIA 19986 |
|
http://xforce.iss.net/xforce/xfdb/26245 (UNKNOWN) XF punbb-misc-xss(26245) |
|
http://www.securityfocus.com/bid/17827 (UNKNOWN) BID 17827 |
|
http://www.punbb.org/download/hdiff/hdiff-1.2.11_to_1.2.12.html (UNKNOWN) CONFIRM http://www.punbb.org/download/hdiff/hdiff-1.2.11_to_1.2.12.html |
|
http://www.punbb.org/changelogs/1.2.11_to_1.2.12.txt (UNKNOWN) CONFIRM http://www.punbb.org/changelogs/1.2.11_to_1.2.12.txt |
|
http://www.osvdb.org/25256 (UNKNOWN) OSVDB 25256 |
|
http://securityreason.com/securityalert/849 (UNKNOWN) SREASON 849 |
- 漏洞信息
| PunBB misc.php 跨站脚本攻击(XSS) 漏洞 | |
| 中危 | 跨站脚本 |
| 2006-05-05 00:00:00 | 2006-05-09 00:00:00 |
| 远程 | |
| PunBB 1.2.11的misc.php 存在跨站脚本攻击(XSS) 漏洞。远程攻击者可以借助req_message参数注入任意Web脚本或HTML，因为redirect_url 参数未清理。 | |
- 公告与补丁
- 漏洞信息
| 25256 | |
| PunBB misc.php redirect_url Parameter XSS | |
| Remote / Network Access | Input Manipulation |
| Loss of Integrity | Upgrade |
| Exploit Public | Vendor Verified |
- 漏洞描述
| PunBB contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'redirect_url' variable upon submission to the misc.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. |
- 时间线
| 2006-05-03 | Unknow |
| 2006-05-03 | Unknow |
- 解决方案
| Upgrade to version 1.2.12 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
- 相关参考
|
人生的价值，并不是用时间，而是用深度去衡量的。