CVE-2006-3956 - Multiple cross-site scripting (XSS) vulnerabilities in contact.php in Advanced Webhost Billing Syste

CVE-2006-3956

Summary

Multiple cross-site scripting (XSS) vulnerabilities in contact.php in Advanced Webhost Billing System (AWBS) 2.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) AccountUsername and (3) Message parameters.

References

http://secunia.com/advisories/21296
http://securityreason.com/securityalert/1317
http://www.osvdb.org/27629
http://www.securityfocus.com/archive/1/441532/100/0/threaded
http://www.securityfocus.com/bid/19226
http://www.vupen.com/english/advisories/2006/3061
https://exchange.xforce.ibmcloud.com/vulnerabilities/28069

Vulnerable Configurations

cpe:2.3:a:total_online_solutions:advanced_webhost_billing_system:2.2.2:*:*:*:*:*:*:*
cpe:2.3:a:total_online_solutions:advanced_webhost_billing_system:2.2.2:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 17-10-2018 - 21:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:N

refmap via4

bid	19226
bugtraq	20060729 XSS vulnerability on AWBS
osvdb	27629
secunia	21296
sreason	1317
vupen	ADV-2006-3061
xf	awbs-contact-xss(28069)

Last major update

17-10-2018 - 21:32

Published

01-08-2006 - 21:04

Last modified

17-10-2018 - 21:32