National Cyber Awareness System

Vulnerability Summary for CVE-2007-0146

Overview

Multiple cross-site scripting (XSS) vulnerabilities in Fix and Chips CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter in (a) delete-announce.php; the (2) Announcement form field in (b) staff.php; the (3) Client Name, (4) Business Name, (5) Street, (6) Address 2, (7) Town/City, (8) Postcode, (9) Phone Number, (10) Email Address and (11) Website Address form fields in (c) new_customer.php; and unspecified fields in (d) search.php and (e) client-results.php.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2007-0081

Hyperlink:http://www.vupen.com/english/advisories/2007/0081

External Source: BUGTRAQ

Name: 20070106 Fix & Chips CMS v1.0

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/456121/100/0/threaded

External Source: SECUNIA

Name: 23625

Type: Advisory

Hyperlink:http://secunia.com/advisories/23625

External Source: XF

Name: fixandchips-multiple-scripts-xss(31319)

Hyperlink:http://xforce.iss.net/xforce/xfdb/31319

External Source: OSVDB

Name: 32650

Hyperlink:http://www.osvdb.org/32650

External Source: OSVDB

Name: 32649

Hyperlink:http://www.osvdb.org/32649

External Source: OSVDB

Name: 32648

Hyperlink:http://www.osvdb.org/32648

External Source: OSVDB

Name: 32647

Hyperlink:http://www.osvdb.org/32647

External Source: OSVDB

Name: 32646

Hyperlink:http://www.osvdb.org/32646

External Source: SREASON

Name: 2119

Hyperlink:http://securityreason.com/securityalert/2119