CVE-2006-4449: XSS

Published Aug 30, 2006

Updated

Cross-site scripting (XSS) vulnerability in attachment.php in MyBulletinBoard (MyBB) 1.1.7 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via a GIF image that contains URL-encoded Javascript, which is rendered by Internet Explorer.

Affected Software

1 affected component

MyBulletinBoard MyBulletinBoard=1.1.7

Remediation

Patch Available

http://secunia.com/advisories/21645

Event History

Aug 30, 2006

CVE Published

01:04 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-4449?

CVE-2006-4449 has a medium severity rating due to its potential to allow cross-site scripting attacks.

How do I fix CVE-2006-4449?

To fix CVE-2006-4449, upgrade to the latest version of MyBulletinBoard that addresses this vulnerability.

Who is affected by CVE-2006-4449?

CVE-2006-4449 affects users of MyBulletinBoard version 1.1.7 and possibly other versions.

What kind of attacks can CVE-2006-4449 enable?

CVE-2006-4449 can enable remote attackers to inject arbitrary web scripts or HTML into the application.

What is the exploit mechanism for CVE-2006-4449?

CVE-2006-4449 exploits a vulnerability in attachment.php that allows injection via a specially crafted GIF image.