Legend :
critical
high
medium
low
other
| id | 43099 |
|---|
| Risiko | other |
|---|
| Familie | CGI abuses : XSS |
|---|
| Kategori | attack |
|---|
| Navn | e107 submitnews.php Cross-Site Scripting |
|---|
| Sammenfatning | Attempts a non-persistent XSS attack on submitnews.php |
|---|
| Beskrivelse | Synopsis :
A PHP script on the remote web server has a cross-site scripting
vulnerability.
Description :
The version of e107 on the remote host has a cross-site scripting
vulnerability in its 'submitnews.php' script. A remote attacker can
exploit this by tricking a user into making a specially crafted POST
request.
There are reportedly several other cross-site scripting and SQL
injection vulnerabilities in this version of e107, though Nessus has
not checked for them.
See also :
http://archives.neohapsis.com/archives/bugtraq/2009-11/0154.html
Solution :
There is no known solution at this time.
Risk factor :
Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
|
|---|
| CVE |
CVE-2009-4083 |
| Bugtraq |
37087 |
| Copyright |
(C) 2009 Tenable Network Security, Inc. |