National Cyber-Alert System

Vulnerability Summary for CVE-2007-4588

Overview

Multiple cross-site scripting (XSS) vulnerabilities in InterWorx Hosting Control Panel (InterWorx-CP) Server Admin Level (NodeWorx) 3.0.2 (1) allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php; and allow remote authenticated users to inject arbitrary web script or HTML via the PATH_INFO to (2) nodeworx.php, (3) users.php, (4) lang.php, (5) themes.php, (6) setup.php, (7) siteworx.php, (8) packages.php, (9) backup.php, (10) import.php, (11) scriptworx.php, (12) resellers.php, (13) reseller-packages.php, (14) http.php, (15) mail.php, (16) ftp.php, (17) mysql.php, (18) sshd.php, (19) nfs.php, (20) cron.php, (21) ip.php, (22) firewall.php, (23) updates.php, (24) rrd.php, or (25) cluster.php.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 25451

Hyperlink:http://www.securityfocus.com/bid/25451

External Source: BUGTRAQ

Name: 20070826 InterWorx-CP Multiple HTML Injections Vulnerabilitie

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/477848/100/0/threaded

External Source: OSVDB

Name: 36766

Hyperlink:http://osvdb.org/36766

External Source: OSVDB

Name: 36765

Hyperlink:http://osvdb.org/36765

External Source: OSVDB

Name: 36764

Hyperlink:http://osvdb.org/36764

External Source: OSVDB

Name: 36763

Hyperlink:http://osvdb.org/36763

External Source: OSVDB

Name: 36762

Hyperlink:http://osvdb.org/36762

External Source: OSVDB

Name: 36761

Hyperlink:http://osvdb.org/36761

External Source: OSVDB

Name: 36759

Hyperlink:http://osvdb.org/36759

External Source: OSVDB

Name: 36758

Hyperlink:http://osvdb.org/36758

External Source: OSVDB

Name: 36757

Hyperlink:http://osvdb.org/36757

External Source: OSVDB

Name: 36756

Hyperlink:http://osvdb.org/36756

External Source: OSVDB

Name: 36755

Hyperlink:http://osvdb.org/36755

External Source: OSVDB

Name: 36753

Hyperlink:http://osvdb.org/36753

External Source: OSVDB

Name: 36752

Hyperlink:http://osvdb.org/36752

External Source: OSVDB

Name: 36751

Hyperlink:http://osvdb.org/36751

External Source: OSVDB

Name: 36750

Hyperlink:http://osvdb.org/36750

External Source: OSVDB

Name: 36749

Hyperlink:http://osvdb.org/36749

External Source: OSVDB

Name: 36748

Hyperlink:http://osvdb.org/36748

External Source: OSVDB

Name: 36747

Hyperlink:http://osvdb.org/36747

External Source: OSVDB

Name: 36746

Hyperlink:http://osvdb.org/36746

External Source: OSVDB

Name: 36745

Hyperlink:http://osvdb.org/36745

External Source: OSVDB

Name: 36744

Hyperlink:http://osvdb.org/36744

External Source: OSVDB

Name: 36743

Hyperlink:http://osvdb.org/36743

External Source: OSVDB

Name: 36742

Hyperlink:http://osvdb.org/36742

External Source: OSVDB

Name: 36740

Hyperlink:http://osvdb.org/36740

External Source: OSVDB

Name: 36739

Hyperlink:http://osvdb.org/36739

External Source: XF

Name: interworx-nodeworx-multiple-file-include(36301)

Hyperlink:http://xforce.iss.net/xforce/xfdb/36301

External Source: XF

Name: interworxcp-index-xss(36297)

Hyperlink:http://xforce.iss.net/xforce/xfdb/36297

External Source: MISC

Name: http://www.hackerscenter.com/archive/view.asp?id=27884

Hyperlink:http://www.hackerscenter.com/archive/view.asp?id=27884

External Source: SREASON

Name: 3070

Hyperlink:http://securityreason.com/securityalert/3070

External Source: SECUNIA

Name: 26586

Hyperlink:http://secunia.com/advisories/26586

External Source: CONFIRM

Name: http://interworx.com/forums/showthread.php?t=2501

Hyperlink:http://interworx.com/forums/showthread.php?t=2501