CVE-2006-3330 - Cross-site scripting (XSS) vulnerability in AddAsset1.php in PHP/MySQL Classifieds (PHP Classifieds)

CVE-2006-3330

Summary

Cross-site scripting (XSS) vulnerability in AddAsset1.php in PHP/MySQL Classifieds (PHP Classifieds) allows remote attackers to execute arbitrary SQL commands via the (1) ProductName ("Title" field), (2) url, and (3) Description parameters, possibly related to issues in add1.php.

References

http://secunia.com/advisories/20880
http://securityreason.com/securityalert/1179
http://securitytracker.com/id?1016407
http://www.securityfocus.com/archive/1/438667/100/0/threaded
http://www.securityfocus.com/bid/18713
http://www.securityfocus.com/bid/18717
http://www.vupen.com/english/advisories/2006/2589
https://exchange.xforce.ibmcloud.com/vulnerabilities/27454

Vulnerable Configurations

cpe:2.3:a:deltascripts:php_classifieds:6.04:*:*:*:*:*:*:*
cpe:2.3:a:deltascripts:php_classifieds:6.04:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 18-10-2018 - 16:46)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

bid	18713 18717
bugtraq	20060628 PHPClassifieds General
sectrack	1016407
secunia	20880
sreason	1179
vupen	ADV-2006-2589
xf	phpclassifieds-postingad-xss(27454)

Last major update

18-10-2018 - 16:46

Published

30-06-2006 - 23:05

Last modified

18-10-2018 - 16:46