National Cyber Awareness System

Vulnerability Summary for CVE-2006-1120

Overview

Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 6.1.1 and earlier, with register_globals enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) its_url parameter in the documents page and (2) url parameter in the send_write page of (a) index.php; (3) subject, and (4) images parameters to (b) calendar.php; (5) bid, (6) replying_msg, (7) subject, (8) body, and (9) mid parameters to (c) forums.php; (10) subject and (11) message parameters to (d) inbox.php; (12) subject_color and (13) email parameters to (e) lostpassword.php; and the (14) c_name, (15) content_inicial, and (16) cid parameters to (f) mycontents.php. NOTE: the calendar.php/day vector is already subsumed by CVE-2006-0220, and the calendar.php/month, calendar.php/year, and search.php/q parameters for calendar.php are already subsumed by CVE-2004-2511.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BUGTRAQ

Name: 20060309 DCP Portal: Multiple XSS Vulnerabilities

Type: Advisory; Exploit

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/427175/100/0/threaded

External Source: MISC

Name: http://www.seclab.tuwien.ac.at/advisories/TUVSA-0603-001.txt

Type: Advisory; Exploit

Hyperlink:http://www.seclab.tuwien.ac.at/advisories/TUVSA-0603-001.txt

External Source: XF

Name: dcpportal-multiple-scripts-xss(25279)

Hyperlink:http://xforce.iss.net/xforce/xfdb/25279

External Source: BID

Name: 17050

Hyperlink:http://www.securityfocus.com/bid/17050

External Source: OSVDB

Name: 23981

Hyperlink:http://www.osvdb.org/23981

External Source: OSVDB

Name: 23980

Hyperlink:http://www.osvdb.org/23980

External Source: OSVDB

Name: 23979

Hyperlink:http://www.osvdb.org/23979

External Source: OSVDB

Name: 23978

Hyperlink:http://www.osvdb.org/23978

External Source: OSVDB

Name: 23977

Hyperlink:http://www.osvdb.org/23977

External Source: OSVDB

Name: 23976

Hyperlink:http://www.osvdb.org/23976

External Source: SREASON

Name: 392

Hyperlink:http://securityreason.com/securityalert/392