National Cyber-Alert System

Vulnerability Summary for CVE-2006-3358

Overview

Multiple cross-site scripting (XSS) vulnerabilities in index.php in NewsPHP 2006 PRO allow remote attackers to inject arbitrary web script or HTML via the (1) words, (2) id, (3) cat_id, and (4) tim parameters, which are not sanitized before being returned in an error page. NOTE: it is possible that some of these vectors are resultant from an SQL injection issue.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BUGTRAQ

Name: 20060629 NewsPHP 2006 PRO XSS SQL injection Vulnerability

Type: Advisory

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/438858/100/0/threaded

External Source: VUPEN

Name: ADV-2006-2640

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2006/2640

External Source: SECUNIA

Name: 20943

Type: Advisory

Hyperlink:http://secunia.com/advisories/20943

External Source: XF

Name: newsphp-multiple-parameters-xss(27508)

Hyperlink:http://xforce.iss.net/xforce/xfdb/27508

External Source: BID

Name: 18726

Hyperlink:http://www.securityfocus.com/bid/18726

External Source: OSVDB

Name: 26977

Hyperlink:http://www.osvdb.org/26977

External Source: OSVDB

Name: 26976

Hyperlink:http://www.osvdb.org/26976

External Source: SREASON

Name: 1188

Hyperlink:http://securityreason.com/securityalert/1188