{"id": "CVE-2010-1606", "bulletinFamily": "NVD", "title": "CVE-2010-1606", "description": "Multiple cross-site scripting (XSS) vulnerabilities in NCT Jobs Portal Script allow remote attackers to inject arbitrary web script or HTML via the (1) search, (2) Keywords, (3) Tags, or (4) Desired City field.", "published": "2010-04-29T13:30:00", "modified": "2017-08-16T21:32:25", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1606", "reporter": "NVD", "references": ["http://packetstormsecurity.org/1004-exploits/nctjobsportal-sqlxss.txt", "https://exchange.xforce.ibmcloud.com/vulnerabilities/58081", "http://www.exploit-db.com/exploits/12370"], "cvelist": ["CVE-2010-1606"], "type": "cve", "lastseen": "2017-08-17T11:14:48", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:ncrypted:nct_jobs_portal_script"], "cvelist": ["CVE-2010-1606"], "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "description": "Multiple cross-site scripting (XSS) vulnerabilities in NCT Jobs Portal Script allow remote attackers to inject arbitrary web script or HTML via the (1) search, (2) Keywords, (3) Tags, or (4) Desired City field.", "edition": 1, "enchantments": {}, "hash": "2a0b865b272a3470545bf1b9f3d0be8aac5f5c466e88d60669a4b8f7c0cc4f8a", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "6e9bdd2021503689a2ad9254c9cdf2b3", "key": "cvss"}, {"hash": "836e7ae5076227501658536cf7b03811", "key": "references"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "cc27defb72d86cd991c0f651746b0b74", "key": "cvelist"}, {"hash": "114b0cfd0170095bef58efbcc0ba22b1", "key": "href"}, {"hash": "d9ef6b436e18aa386473d948c2007457", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "64d40a2486cf54417785025d8c26fe30", "key": "modified"}, {"hash": "c9f777b086ca440646250c55768b5187", "key": "cpe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "9091c9796f3d9f93be4f52a77a151777", "key": "published"}, {"hash": "57fbb1aa685aeb737bd38efca260f1ff", "key": "description"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1606", "id": "CVE-2010-1606", "lastseen": "2016-09-03T13:50:24", "modified": "2010-04-30T00:00:00", "objectVersion": "1.2", "published": "2010-04-29T13:30:00", "references": ["http://xforce.iss.net/xforce/xfdb/58081", "http://packetstormsecurity.org/1004-exploits/nctjobsportal-sqlxss.txt", "http://www.exploit-db.com/exploits/12370"], "reporter": "NVD", "scanner": [], "title": "CVE-2010-1606", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T13:50:24"}], "edition": 2, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "c9f777b086ca440646250c55768b5187"}, {"key": "cvelist", "hash": "cc27defb72d86cd991c0f651746b0b74"}, {"key": "cvss", "hash": "6e9bdd2021503689a2ad9254c9cdf2b3"}, {"key": "description", "hash": "57fbb1aa685aeb737bd38efca260f1ff"}, {"key": "href", "hash": "114b0cfd0170095bef58efbcc0ba22b1"}, {"key": "modified", "hash": "8865ee6ac7ef60f2ffba60e6f6899abd"}, {"key": "published", "hash": "9091c9796f3d9f93be4f52a77a151777"}, {"key": "references", "hash": "0ae4d09426eb6f23209108371ab07e4a"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "d9ef6b436e18aa386473d948c2007457"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "27213a5f45ef54e58969061e9d445e554748555a4c67f81e453a61d72794291b", "viewCount": 0, "enchantments": {"score": {"value": 4.3, "vector": "NONE", "modified": "2017-08-17T11:14:48"}, "dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:12370"]}], "modified": "2017-08-17T11:14:48"}, "vulnersScore": 4.3}, "objectVersion": "1.3", "cpe": ["cpe:/a:ncrypted:nct_jobs_portal_script"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"exploitdb": [{"lastseen": "2016-02-01T16:19:10", "bulletinFamily": "exploit", "description": "XSS and Authentication bypass in NCT Jobs Portal Script. CVE-2010-1604,CVE-2010-1606. Webapps exploit for php platform", "modified": "2010-04-24T00:00:00", "published": "2010-04-24T00:00:00", "id": "EDB-ID:12370", "href": "https://www.exploit-db.com/exploits/12370/", "type": "exploitdb", "title": "NCT Jobs Portal Script - XSS and Authentication Bypass", "sourceData": "# Exploit Title: XSS and Authentication bypass in NCT Jobs Portal Script\r\n# Date: 24-apr-2010\r\n# Author: Sid3^effects\r\n# Software Link: N/a\r\n# CVE : []\r\n# Code : [] ______________________________________________________________________________\r\n XSS and Authentication bypass in NCT Jobs Portal Script\r\n Vendor:http://www.ncrypted.net/\r\n ___________________________Author:Sid3^effects_________________________________\r\n \r\n\r\nDescription :\r\n\r\nNCT Jobs Portal script is a web product for running powerful and customized job portals. Be it a fresh site that you want to launch or be it for integration into your already existing website, NCT Jobs Portal is everything you need when it comes to job portal or business networking solution. Jobs Portal comes with a front-end and a back-end (Admin Panel). Admin Panel has a wide range of functions along with a CMS (Content Management System) which will easily enpower you to customize and manage your very own Jobs Portal.\r\n\r\nscript cost :$99 \r\n---------------------------------------------------------------------------\r\n\t* Authentication bypass:\r\n\r\n\tThe following script has authentication bypass in the admin login \r\n\r\n\tuse ' or 1=1 or ''=' in both login and password.\r\n\r\n---------------------------------------------------------------------------\r\n\t* XSS (cross site scripting ) :\r\n \r\n\tXSS is also found in the search field. \r\n\r\n Parameter Name: Keywords or Tags or Desired City\r\n Parameter Type: Querystring \r\n Attack Pattern: '\"--><script>alert(0x000872)</script> \r\n---------------------------------------------------------------------------\r\n\r\nShoutZ :\r\n------- \r\n ---Indian Cyber warriors--Andhra hackers-- \r\n\r\nGreetz :\r\n--------\r\n ---*L0rd \u00c7rusAd\u00ear*---d4rk-blu\u2122\u00ae [ICW]---R45C4L idi0th4ck3r---CR4C|< 008---M4n0j--", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/12370/"}]}