Vulnerability-Lookup

FKIE_CVE-2006-4972

Vulnerability from fkie_nvd - Published: 2006-09-25 01:07 - Updated: 2025-04-03 01:03

Severity ?

Summary

Cross-site scripting (XSS) vulnerability in archive/index.php/forum-4.html in MyBB (aka MyBulletinBoard) allows remote attackers to inject arbitrary web script or HTML via the navbits[][name] parameter.

References

URL	Tags
cve@mitre.org	http://secunia.com/advisories/21972	Vendor Advisory
cve@mitre.org	http://securityreason.com/securityalert/1628
cve@mitre.org	http://www.securityfocus.com/archive/1/446093/100/0/threaded
cve@mitre.org	http://www.vupen.com/english/advisories/2006/3666
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/21972	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://securityreason.com/securityalert/1628
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/446093/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2006/3666

Impacted products

Vendor	Product	Version
mybulletinboard	mybulletinboard	1.0.1
mybulletinboard	mybulletinboard	1.0.2
mybulletinboard	mybulletinboard	1.0.3
mybulletinboard	mybulletinboard	1.0.4
mybulletinboard	mybulletinboard	1.0_final
mybulletinboard	mybulletinboard	1.0_preview_release_2
mybulletinboard	mybulletinboard	1.0_rc2
mybulletinboard	mybulletinboard	1.1
mybulletinboard	mybulletinboard	1.1.1
mybulletinboard	mybulletinboard	1.1.2
mybulletinboard	mybulletinboard	1.1.3
mybulletinboard	mybulletinboard	1.1.4
mybulletinboard	mybulletinboard	1.1.5
mybulletinboard	mybulletinboard	1.1.7
mybulletinboard	mybulletinboard	1.10
mybulletinboard	mybulletinboard	1.14
mybulletinboard	mybulletinboard	1.20

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F3B187F-D0C5-4001-B877-3B0122784BB2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D04152D8-60BE-4362-BF68-688DE53A066C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "98789943-2C7D-404E-B61E-04C436C1681C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "678B50B3-D151-40ED-8CAA-C12FC5BA4520",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.0_final:*:*:*:*:*:*:*",
              "matchCriteriaId": "9114F7E3-D7E4-4DDF-8826-195EC63117E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.0_preview_release_2:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD8FD48E-3B6A-4FD9-AA65-CCED2CC6E6A7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.0_rc2:*:*:*:*:*:*:*",
              "matchCriteriaId": "894A8A8C-24BE-4B28-9CF4-46DD04ED38BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "64E11CB6-E5E5-42CF-A2A4-B1DD3ABADBAD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1079E0F-7B89-45A9-83AD-F72470A63B07",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "59C3A929-B608-42FC-BB31-7599146E8CB6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F4409B6-9F4D-4136-BA74-43736215A122",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "D70B64CF-6EF1-487A-9617-68F904ACE727",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "94EC0E67-111A-4989-A311-6B051D37CEE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "D6942A9C-55E6-4A87-903F-3C8314EA4EA5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "0846A9BC-9FFC-4C93-911D-431688A6FB58",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "42490451-EA60-4C61-99FB-526EFA3CBA86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mybulletinboard:mybulletinboard:1.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "956399FC-9377-478D-98E9-0024C61CA7E7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in archive/index.php/forum-4.html in MyBB (aka MyBulletinBoard) allows remote attackers to inject arbitrary web script or HTML via the navbits[][name] parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en archive/index.php/forum-4.html en MyBB (tambi\u00e9n conocido c\u00f3mo MyBulletinBoard) permite a un atacante remoto inyectar una secuencia de comandos web o HTML de su elecci\u00f3n a trav\u00e9s del par\u00e1metro navbits[][name]."
    }
  ],
  "evaluatorSolution": "Successful exploitation requires that \"register_globals\" is enabled.",
  "id": "CVE-2006-4972",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2006-09-25T01:07:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/21972"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/1628"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/446093/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2006/3666"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/21972"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/1628"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/446093/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/3666"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2006-4972 (GCVE-0-2006-4972)

Vulnerability from cvelistv5 – Published: 2006-09-25 01:00 – Updated: 2024-08-07 19:32

Summary

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://www.vupen.com/english/advisories/2006/3666	vdb-entryx_refsource_VUPEN
	http://www.securityfocus.com/archive/1/446093/100…	mailing-listx_refsource_BUGTRAQ
	http://securityreason.com/securityalert/1628	third-party-advisoryx_refsource_SREASON
	http://secunia.com/advisories/21972	third-party-advisoryx_refsource_SECUNIA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T19:32:22.919Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2006-3666",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/3666"
          },
          {
            "name": "20060915 MyBB Full path and Cross site scripting vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/446093/100/0/threaded"
          },
          {
            "name": "1628",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/1628"
          },
          {
            "name": "21972",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21972"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-09-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in archive/index.php/forum-4.html in MyBB (aka MyBulletinBoard) allows remote attackers to inject arbitrary web script or HTML via the navbits[][name] parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "ADV-2006-3666",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/3666"
        },
        {
          "name": "20060915 MyBB Full path and Cross site scripting vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/446093/100/0/threaded"
        },
        {
          "name": "1628",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/1628"
        },
        {
          "name": "21972",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21972"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-4972",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in archive/index.php/forum-4.html in MyBB (aka MyBulletinBoard) allows remote attackers to inject arbitrary web script or HTML via the navbits[][name] parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ADV-2006-3666",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/3666"
            },
            {
              "name": "20060915 MyBB Full path and Cross site scripting vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/446093/100/0/threaded"
            },
            {
              "name": "1628",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/1628"
            },
            {
              "name": "21972",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21972"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-4972",
    "datePublished": "2006-09-25T01:00:00",
    "dateReserved": "2006-09-24T00:00:00",
    "dateUpdated": "2024-08-07T19:32:22.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2006-4972

CVE-2006-4972 (GCVE-0-2006-4972)

Tags

Sightings

Nomenclature