20149Third-party advisory
http://secunia.com/advisories/20149 CVE-2006-2491
BoastMachine 3.1 - 'admin.php' Cross-Site Scripting
Record summary
CVE-2006-2491 has a selected CVSS score of 6.8; EIP currently links 1 catalogued exploit.
Description
Cross-site scripting (XSS) vulnerability in (1) index.php and (2) bmc/admin.php in BoastMachine (bMachine) 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly filtered when it is accessed using the $_SERVER["PHP_SELF"] variable.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBBoastMachine 3.1 - 'admin.php' Cross-Site ScriptingExploitDB exploitby Yunus Emre YilmazNot analyzed1 file
References
10725Third-party advisory
http://securityreason.com/securityalert/725 927Third-party advisory
http://securityreason.com/securityalert/927 25617vdb entry
http://www.osvdb.org/25617 25618vdb entry
http://www.osvdb.org/25618 20060517 Boastmachine Cross Site Scripting Vulnerabilitymailing list
http://www.securityfocus.com/archive/1/434294/100/0/threaded 18012vdb entry
http://www.securityfocus.com/bid/18012 ADV-2006-1853vdb entry
http://www.vupen.com/english/advisories/2006/1853 boastmachine-phpself-xss(26518)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/26518 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2006-2491