CVE-2005-1508 - Multiple cross-site scripting (XSS) vulnerabilities in PwsPHP 1.2.2 allow remote attackers to inject

CVE-2005-1508

Summary

Multiple cross-site scripting (XSS) vulnerabilities in PwsPHP 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) month or (2) annee parameters to the news module, (3) nbractif or (4) annee parameters to the stats module, (5) id parameter to profil.php, (6) mb_lettre or (7) lettre parameter to memberlist.php, or (8) chaine_search, or (9) auteur_search parameter to the recherche module.

References

Vulnerable Configurations

cpe:2.3:a:pwsphp:pwsphp:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:pwsphp:pwsphp:1.2.2:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 11-07-2017 - 01:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

bugtraq	20050507 PwsPHP v1.2.2 Final - Multiples vulnerabilities
osvdb	16228 16229 16230 16231 16232
secunia	15315
vupen	ADV-2005-0503
xf	pwsphp-mulitple-scripts-xss(20500)

Last major update

11-07-2017 - 01:32

Published

11-05-2005 - 04:00

Last modified

11-07-2017 - 01:32