biyosecurity.be
http://biyosecurity.be/bugs/wmnews.txt CVE-2006-1233
WMNews - 'wmview.php?ArtCat' Cross-Site Scripting
Record summary
CVE-2006-1233 has a selected CVSS score of 4.3; EIP currently links 3 catalogued exploits.
Description
Multiple cross-site scripting (XSS) vulnerabilities in WMNews allow remote attackers to inject arbitrary web script or HTML via the (1) ArtCat parameter to wmview.php, (2) ctrrowcol parameter to footer.php, or (3) ArtID parameter to wmcomments.php.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 3
Proofs of concept
3Catalogued exploits
ExploitDBWMNews - 'wmview.php?ArtCat' Cross-Site ScriptingExploitDB exploitby R00T3RR0RNot analyzed1 file
ExploitDBWMNews - 'footer.php?ctrrowcol' Cross-Site ScriptingExploitDB exploitby R00T3RR0RNot analyzed1 file
ExploitDBWMNews - 'wmcomments.php?ArtID' Cross-Site ScriptingExploitDB exploitby R00T3RR0RNot analyzed1 file
References
1019204Third-party advisory
http://secunia.com/advisories/19204 23840vdb entry
http://www.osvdb.org/23840 23841vdb entry
http://www.osvdb.org/23841 23842vdb entry
http://www.osvdb.org/23842 20060312 WMNews Cross Site Scriptingmailing list
http://www.securityfocus.com/archive/1/427479/100/0/threaded 17076vdb entry
http://www.securityfocus.com/bid/17076 ADV-2006-0939vdb entry
http://www.vupen.com/english/advisories/2006/0939 wmnews-multiple-scripts-xss(25210)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/25210 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2006-1233