CVE-2006-3089 - Multiple cross-site scripting (XSS) vulnerabilities in PhpMyFactures 1.0, and possibly 1.2 and earli

CVE-2006-3089

Summary

Multiple cross-site scripting (XSS) vulnerabilities in PhpMyFactures 1.0, and possibly 1.2 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) prefixe_dossier parameter in (a) /inc/header.php; (2) msg parameter in (b) /remises/ajouter_remise.php, (c) /tva/ajouter_tva.php, (d) /stocks/ajouter.php, (e) /pays/ajouter_pays.php, (f) /produits/ajouter_cat.php, (g) /produits/ajouter_produit.php and (h) /produits/modifier_cat.php; (3) tire parameter in /remises/ajouter_remise.php; (4) quantite, (5) taux and (6) date parameter in /stocks/ajouter.php; and (7) pays and (8) prefixe parameter in /pays/ajouter_pays.php.

References

Vulnerable Configurations

cpe:2.3:a:phpmyfactures:phpmyfactures:1.0:*:*:*:*:*:*:*
cpe:2.3:a:phpmyfactures:phpmyfactures:1.0:*:*:*:*:*:*:*
cpe:2.3:a:phpmyfactures:phpmyfactures:*:*:*:*:*:*:*:*
cpe:2.3:a:phpmyfactures:phpmyfactures:*:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 18-10-2018 - 16:45)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:N

refmap via4

bugtraq	20060610 PhpMyFactures 1.0 Cross Site Scripting, SQL Injection, Full Path Disclosure and others
misc	http://www.acid-root.new.fr/advisories/phpmyfactures.txt
osvdb	26478 26479 26480 26481 26482 26483 26484 26485
secunia	20642
sreason	1111
xf	phpmyfactures-multiple-scripts-xss(27208)

Last major update

18-10-2018 - 16:45

Published

19-06-2006 - 21:02

Last modified

18-10-2018 - 16:45