{"id": "CVE-2006-0463", "bulletinFamily": "NVD", "title": "CVE-2006-0463", "description": "Cross-site scripting (XSS) vulnerability in IdeoContent Manager allows remote attackers to inject arbitrary web script or HTML via the (1) goto_id parameter to index.php or (2) page parameter to news_full.php.", "published": "2006-01-27T23:03:00", "modified": "2008-09-05T20:59:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-0463", "reporter": "cve@mitre.org", "references": ["http://osvdb.org/ref/22/22712-ideocontent.txt", "http://www.osvdb.org/22713", "http://www.osvdb.org/22712"], "cvelist": ["CVE-2006-0463"], "type": "cve", "lastseen": "2019-05-29T18:08:30", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "ebb53988d1f8f585bbd1b31aabc76ae6"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "6068dfa688b842956d27b532b927f807"}, {"key": "cpe23", "hash": "2febd8226b06960e11d761a4c3fa103d"}, {"key": "cvelist", "hash": "6f3e2965effc3744e3b98af076bd9337"}, {"key": "cvss", "hash": "f74a1c24e49a5ecb0eefb5e51d4caa14"}, {"key": "cvss2", "hash": "1376299678e4b22a45cbb6e661929c18"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "78a7a5cbaf09985c14389298e454e7db"}, {"key": "description", "hash": "b0f3c5c9fb369a3af5c78bc2ca06ce93"}, {"key": "href", "hash": "9b8f8f9c80917bd2e0f35219d8ce90a3"}, {"key": "modified", "hash": "09d027d45aa72668972cccb06d05dda5"}, {"key": "published", "hash": "89232649eb648c6d05eba083c6d82c8d"}, {"key": "references", "hash": "e6e56c56c75efed92729bb5e98ea2ada"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "883fbed8fa6261a3220730d8bbdf1d4e"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "6d2160d825f5c9f82d8c3c67a3af92378331d875c75c27b60471af6332eb2fc1", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:22713", "OSVDB:22712"]}], "modified": "2019-05-29T18:08:30"}, "score": {"value": 4.5, "vector": "NONE", "modified": "2019-05-29T18:08:30"}, "vulnersScore": 4.5}, "objectVersion": "1.3", "cpe": ["cpe:/a:ideosoft_design:ideocontent_manager:*"], "affectedSoftware": [{"name": "ideosoft_design ideocontent_manager", "operator": "eq", "version": "*"}], "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:ideosoft_design:ideocontent_manager:*:*:*:*:*:*:*:*"], "cwe": ["NVD-CWE-Other"]}

{"osvdb": [{"lastseen": "2017-04-28T13:20:19", "bulletinFamily": "software", "description": "## Vulnerability Description\nIdeoContent Manager contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'goto_id' variables upon submission to the 'index.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nIdeoContent Manager contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'goto_id' variables upon submission to the 'index.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Manual Testing Notes\nhttp://[target]/index.php?goto_id=\"><script>alert(document.cookie)</script>\n## References:\nVendor URL: http://www.ideosoft.ro/\n[Related OSVDB ID: 22712](https://vulners.com/osvdb/OSVDB:22712)\n[Related OSVDB ID: 22714](https://vulners.com/osvdb/OSVDB:22714)\nOther Advisory URL: http://osvdb.org/ref/22/22712-ideocontent.txt\n[CVE-2006-0463](https://vulners.com/cve/CVE-2006-0463)\n", "modified": "2006-01-18T00:00:00", "published": "2006-01-18T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:22713", "id": "OSVDB:22713", "type": "osvdb", "title": "IdeoContent Manager index.php goto_id Variable XSS", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-04-28T13:20:19", "bulletinFamily": "software", "description": "## Vulnerability Description\nIdeoContent Manager contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'page' variable upon submission to the 'news_full.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nIdeoContent Manager contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'page' variable upon submission to the 'news_full.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Manual Testing Notes\nhttp://[target]/news_full.php?&page=2\"><script>alert(document.cookie)</script>\n## References:\nVendor URL: http://www.ideosoft.ro/\n[Related OSVDB ID: 22713](https://vulners.com/osvdb/OSVDB:22713)\n[Related OSVDB ID: 22714](https://vulners.com/osvdb/OSVDB:22714)\nOther Advisory URL: http://osvdb.org/ref/22/22712-ideocontent.txt\n[CVE-2006-0463](https://vulners.com/cve/CVE-2006-0463)\n", "modified": "2006-01-18T00:00:00", "published": "2006-01-18T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:22712", "id": "OSVDB:22712", "type": "osvdb", "title": "IdeoContent Manager news_full.php page Variable XSS", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}]}