CVE-2006-2088 - Multiple cross-site scripting (XSS) vulnerabilities in Devsyn Open Bulletin Board (OpenBB) 1.0.6 all

CVE-2006-2088

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Devsyn Open Bulletin Board (OpenBB) 1.0.6 allow remote attackers to inject arbitrary web script or HTML via (1) the FID parameter in board.php and (2) the TID parameter in read.php. NOTE: the SQL injection issues are already covered by CVE-2005-1612 (read.php) and CVE-2005-2566 (board.php).

References

http://securityreason.com/securityalert/806
http://www.securityfocus.com/archive/1/432106/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/26095

Vulnerable Configurations

cpe:2.3:a:devsyn:open_bulletin_board:1.0.6:*:*:*:*:*:*:*
cpe:2.3:a:devsyn:open_bulletin_board:1.0.6:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 18-10-2018 - 16:38)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:N

refmap via4

bugtraq	20060426 Open Bulletin Board < Multiple Vulnerability
sreason	806
xf	openbb-board-read-xss(26095)

Last major update

18-10-2018 - 16:38

Published

29-04-2006 - 10:02

Last modified

18-10-2018 - 16:38