NewsPHP multiple parameters cross-site scripting
| newsphp-multiple-parameters-xss (27508) |  Medium Risk |
Description:
NewsPHP is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the index.php script. A remote attacker could exploit this vulnerability using the 'words', 'id', 'cat_id' or 'tim' parameter to execute script in a victim's Web browser within the security context of the hosting Web site, allowing the attacker to steal the victim's cookie-based authentication credentials.
Platforms Affected:
- NewsPHP.com, NewsPHP
Remedy:
No remedy available as of June 27, 2009.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Thu Jun 29 2006 - 05:46:47 CDT, NewsPHP 2006 PRO XSS SQL injection Vulnerability at http://archives.neohapsis.com/archives/bugtraq/2006-07/0001.html.
- NewsPHP.com Web site, NewsPHP at http://www.newsphp.com/.
- BID-18726: NewsPHP 2006 PRO Multiple Input Validation Vulnerabilities
- CVE-2006-3358: Multiple cross-site scripting (XSS) vulnerabilities in index.php in NewsPHP 2006 PRO allow remote attackers to inject arbitrary web script or HTML via the (1) words, (2) id, (3) cat_id, and (4) tim parameters, which are not sanitized before being returned in an error page. NOTE: it is possible that some of these vectors are resultant from an SQL injection issue.
- OSVDB ID: 26976: NewsPHP index.php Multiple Variable XSS
- OSVDB ID: 26977: NewsPHP index.php Multiple Variable SQL Injection
- SA20943: NewsPHP Cross-Site Scripting Vulnerabilities
- VUPEN/ADV-2006-2640: NewsPHP words and tim Parameters Handling Cross Site Scripting Vulnerabilities
Reported:
Jun 29, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net