ID CVE-2006-4608 Type cve Reporter NVD Modified 2017-10-10T21:31:14
Description
Multiple cross-site scripting (XSS) vulnerabilities in Longino Jacome php-Revista 1.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cadena parameter in busqueda.php and the (2) email parameter in lista.php.
{"result": {"osvdb": [{"id": "OSVDB:28450", "type": "osvdb", "title": "php-revista busqueda.php cadena Variable XSS", "description": "## Vulnerability Description\nphp-revista contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'cadena' variable upon submission to the 'busqueda.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nphp-revista contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'cadena' variable upon submission to the 'busqueda.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Manual Testing Notes\nhttp://[target]/estilo/[ANY STYLE]/busqueda.php?cadena=<XSS>\n## References:\nVendor URL: http://php-revista.sourceforge.org/\n[Secunia Advisory ID:21738](https://secuniaresearch.flexerasoftware.com/advisories/21738/)\n[Related OSVDB ID: 28443](https://vulners.com/osvdb/OSVDB:28443)\n[Related OSVDB ID: 28445](https://vulners.com/osvdb/OSVDB:28445)\n[Related OSVDB ID: 28448](https://vulners.com/osvdb/OSVDB:28448)\n[Related OSVDB ID: 28446](https://vulners.com/osvdb/OSVDB:28446)\n[Related OSVDB ID: 28449](https://vulners.com/osvdb/OSVDB:28449)\n[Related OSVDB ID: 28451](https://vulners.com/osvdb/OSVDB:28451)\n[Related OSVDB ID: 28452](https://vulners.com/osvdb/OSVDB:28452)\n[Related OSVDB ID: 28447](https://vulners.com/osvdb/OSVDB:28447)\nMail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2006-09/0017.html\n[CVE-2006-4608](https://vulners.com/cve/CVE-2006-4608)\nBugtraq ID: 19818\n", "published": "2006-09-01T05:34:21", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:28450", "cvelist": ["CVE-2006-4608"], "lastseen": "2017-04-28T13:20:24"}], "exploitdb": [{"id": "EDB-ID:8425", "type": "exploitdb", "title": "php-revista 1.1.2 rfi/sqli/cb/XSS Multiple Vulnerabilities", "description": "PHP-Revista 1.1.2 (RFI/SQLi/CB/XSS) Multiple Remote Vulnerabilities. CVE-2006-4605,CVE-2006-4606,CVE-2006-4607,CVE-2006-4608. Webapps exploit for php platform", "published": "2009-04-14T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/8425/", "cvelist": ["CVE-2006-4607", "CVE-2006-4608", "CVE-2006-4606", "CVE-2006-4605"], "lastseen": "2016-02-01T05:29:57"}]}}