National Cyber Awareness System

Vulnerability Summary for CVE-2006-3312

Overview

Multiple cross-site scripting (XSS) vulnerabilities in ashmans and Bill Echlin QaTraq 6.5 RC and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) link_print, (2) link_upgrade, (3) link_sql, (4) link_next, (5) link_prev, and (6) link_list parameters in top.inc as included by queries_view_search.php; the (7) msg, (8) component_name, and (9) component_desc parameters in (a) components_copy_content.php, (b) components_modify_content.php, and (c) components_new_content.php; the (10) title, (11) version, and (12) content parameters in design_copy_content.php; the (13) plan_title and (14) plan_content parameters in design_copy_plan_search.php; the (15) title, (16) minor_version, (17) new_version, and (18) content parameters in design_modify_content.php; the (19) title, (20) version, and (21) content parameters in design_new_content.php; the (22) plan_name and (23) plan_desc parameters in design_new_search.php; the (24) file_name parameter in download.php; the (25) username and (26) password parameters in login.php; the (27) title, (28) version, and (29) content parameters in phase_copy_content.php; the (30) content parameter in phase_delete_search.php; the (31) title, (32) minor_version, (33) new_version, and (34) content parameters in phase_modify_content.php; the (35) content, (36) title, (37) version, and (38) content parameters in phase_modify_search.php; the (39) content parameter in phase_view_search.php; the (40) msg, (41) product_name, and (42) product_desc parameters in products_copy_content.php; and possibly the (43) product_name and (44) product_desc parameters in (d) products_copy_search.php, and a large number of additional parameters and executables. NOTE: the vendor notified CVE via e-mail that this issue has been fixed in the 6.8 RC release.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://www.testmanagement.com/

Hyperlink:http://www.testmanagement.com/

External Source: BID

Name: 18620

Hyperlink:http://www.securityfocus.com/bid/18620

External Source: BUGTRAQ

Name: 20060623 QaTraq 6.5 RC: Multiple XSS Vulnerabilities

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/438151/100/0/threaded

External Source: OSVDB

Name: 27616

Hyperlink:http://www.osvdb.org/27616

External Source: OSVDB

Name: 27615

Hyperlink:http://www.osvdb.org/27615

External Source: OSVDB

Name: 27614

Hyperlink:http://www.osvdb.org/27614

External Source: OSVDB

Name: 27613

Hyperlink:http://www.osvdb.org/27613

External Source: OSVDB

Name: 27612

Hyperlink:http://www.osvdb.org/27612

External Source: OSVDB

Name: 27611

Hyperlink:http://www.osvdb.org/27611

External Source: OSVDB

Name: 27610

Hyperlink:http://www.osvdb.org/27610

External Source: OSVDB

Name: 27609

Hyperlink:http://www.osvdb.org/27609

External Source: OSVDB

Name: 27608

Hyperlink:http://www.osvdb.org/27608

External Source: OSVDB

Name: 27607

Hyperlink:http://www.osvdb.org/27607

External Source: OSVDB

Name: 27606

Hyperlink:http://www.osvdb.org/27606

External Source: OSVDB

Name: 27605

Hyperlink:http://www.osvdb.org/27605

External Source: OSVDB

Name: 27601

Hyperlink:http://www.osvdb.org/27601

External Source: OSVDB

Name: 27600

Hyperlink:http://www.osvdb.org/27600

External Source: OSVDB

Name: 27599

Hyperlink:http://www.osvdb.org/27599

External Source: VIM

Name: 20060811 QaTraq multiple cross-site scripting vulnerabilities (fwd)

Hyperlink:http://www.attrition.org/pipermail/vim/2006-August/000969.html

External Source: SECTRACK

Name: 1016381

Hyperlink:http://securitytracker.com/id?1016381

External Source: MISC

Name: http://seclab.tuwien.ac.at/advisories/TUVSA-0606-001.txt

Hyperlink:http://seclab.tuwien.ac.at/advisories/TUVSA-0606-001.txt

External Source: XF

Name: qatraq-multiple-xss(27355)

Hyperlink:http://xforce.iss.net/xforce/xfdb/27355

External Source: OSVDB

Name: 27604

Hyperlink:http://www.osvdb.org/27604

External Source: OSVDB

Name: 27603

Hyperlink:http://www.osvdb.org/27603

External Source: OSVDB

Name: 27602

Hyperlink:http://www.osvdb.org/27602

External Source: SREASON

Name: 1169

Hyperlink:http://securityreason.com/securityalert/1169