CVE-2006-3308

Vulnerability

The wpprop code in Project EROS bbsengine contains an unspecified vulnerability related to the handling of [img] tags. It is likely a cross-site scripting (XSS) issue that allows remote injection. The affected versions are those prior to the 20060622-0315 release [1].

Exploitation

An attacker can exploit the issue remotely by crafting malicious [img] tags, potentially without requiring authentication. The exact sequence of steps is not detailed, but the attack vector is network-based and involves injecting the tags into content processed by the bbsengine [1].

Impact

Successful exploitation could lead to unauthorized actions in the context of a victim's session, such as data disclosure or session hijacking. The impact is categorized as unknown in the advisory, but due to the XSS nature, it could compromise confidentiality and integrity [1].

Mitigation

The fix was released on 2006-06-22 as version 20060622-0315. Users should upgrade to this version or later. No workaround is documented in the available reference [1].