CVE-2007-3596 - inc/vul_check.inc in phpVideoPro before 0.8.8 permits non-alphanumeric characters in the sess_id par

CVE-2007-3596

Summary

inc/vul_check.inc in phpVideoPro before 0.8.8 permits non-alphanumeric characters in the sess_id parameter, which has unknown impact and remote attack vectors, probably cross-site scripting (XSS).

References

Vulnerable Configurations

cpe:2.3:a:izzysoft:phpvideopro:*:*:*:*:*:*:*:*
cpe:2.3:a:izzysoft:phpvideopro:*:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 29-07-2017 - 01:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:N

refmap via4

bid	24644
confirm	http://phpvideopro.cvs.sourceforge.net/phpvideopro/phpvideopro/inc/vul_check.inc?r1=1.10&r2=1.11 http://www.qumran.org/homes/izzy/software/pvp-dev/help/?topic=history
misc	http://sourceforge.net/project/shownotes.php?release_id=518490&group_id=18639
osvdb	36349
secunia	25815
xf	phpvideopro-sessid-xss(35120)

Last major update

29-07-2017 - 01:32

Published

06-07-2007 - 18:30

Last modified

29-07-2017 - 01:32