Vulnerabilities > CVE-2006-1590 - Cross-Site Scripting vulnerability in Basic Analysis and Security Engine PrintFreshPage

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
network
kevin-johnson
roman-danyliw
exploit available
NVD
Published: 2006-04-03
Updated: 2017-07-20

Summary

Cross-site scripting (XSS) vulnerability in the PrintFreshPage function in (1) Basic Analysis and Security Engine (BASE) 1.2.4 and (2) Analysis Console for Intrusion Databases (ACID) 0.9.6b23 allows remote attackers to inject arbitrary web script or HTML via the (a) back parameter to base_graph_main.php, (b) netmask parameter to base_stat_ipaddr.php, or (c) submit parameter to base_qry_alert.php within BASE, or (d) query string to acid_main.php in ACID, which causes the request URI ($_SERVER['REQUEST_URI']) to be inserted into a refresh operation. Analysis Console for Intrusion Databases - The vendor has discontinued this product and therefore has no patch or upgrade that mitigates this problem. Basic Analysis and Security Engine - Upgrade to cvs version or version 1.2.5 (daiga) or higher, as it has been reported to fix this vulnerability.

Vulnerable Configurations

Part Description Count
Application
Kevin_Johnson
15
Application
Roman_Danyliw
1

Exploit-Db

descriptionBasic Analysis and Security Engine 1.2.4 PrintFreshPage Cross-Site Scripting Vulnerability. CVE-2006-1590. Webapps exploit for php platform
idEDB-ID:27574
last seen2016-02-03
modified2003-04-06
published2003-04-06
reporterAdam Ely
sourcehttps://www.exploit-db.com/download/27574/
titleBasic Analysis and Security Engine 1.2.4 PrintFreshPage Cross-Site Scripting Vulnerability

References