{"id": "EDB-ID:25438", "type": "exploitdb", "bulletinFamily": "exploit", "title": "MVNForum 1.0 - Search Cross-Site Scripting Vulnerability", "description": "MVNForum 1.0 Search Cross-Site Scripting Vulnerability. CVE-2005-1183. Webapps exploit for php platform", "published": "2005-04-18T00:00:00", "modified": "2005-04-18T00:00:00", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "https://www.exploit-db.com/exploits/25438/", "reporter": "hoang yen", "references": [], "cvelist": ["CVE-2005-1183"], "lastseen": "2016-02-03T01:22:20", "viewCount": 6, "enchantments": {"score": {"value": 4.4, "vector": "NONE", "modified": "2016-02-03T01:22:20", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2005-1183"]}, {"type": "osvdb", "idList": ["OSVDB:16962"]}, {"type": "openvas", "idList": ["OPENVAS:136141256231018359"]}, {"type": "nessus", "idList": ["MVNFORUM_SEARCH_XSS.NASL"]}], "modified": "2016-02-03T01:22:20", "rev": 2}, "vulnersScore": 4.4}, "sourceHref": "https://www.exploit-db.com/download/25438/", "sourceData": "source: http://www.securityfocus.com/bid/13213/info\r\n\r\nmvnForum is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.\r\n\r\nAn attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. \r\n\r\nhttp://www.example.com/mvnforum/Search=\"><script>alert('XSS found here')</script> ", "osvdbidlist": ["16962"]}

{"cve": [{"lastseen": "2020-10-03T11:34:54", "description": "Cross-site scripting (XSS) vulnerability in mvnForum 1.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the Search parameter.", "edition": 3, "cvss3": {}, "published": "2005-05-02T04:00:00", "title": "CVE-2005-1183", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2005-1183"], "modified": "2017-07-11T01:32:00", "cpe": ["cpe:/a:mvnforum:mvnforum:1.0_rc4"], "id": "CVE-2005-1183", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-1183", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:mvnforum:mvnforum:1.0_rc4:*:*:*:*:*:*:*"]}], "openvas": [{"lastseen": "2020-05-08T16:40:14", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-1183"], "description": "The version of mvnForum installed on the remote host is prone to\n cross-site scripting attacks due to its failure to sanitize\n user-supplied input to the search field.", "modified": "2020-05-06T00:00:00", "published": "2005-11-03T00:00:00", "id": "OPENVAS:136141256231018359", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231018359", "type": "openvas", "title": "MVNForum Search Cross-Site Scripting Vulnerability", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# MVNForum Search Cross-Site Scripting Vulnerability\n#\n# Authors:\n# Josh Zlatin-Amishav <josh at tkos dot co dot il>\n# Fixed by Tenable:\n# - Improved description\n# - Adjusted XSS regex.\n#\n# Copyright:\n# Copyright (C) 2005 Josh Zlatin-Amishav\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.18359\");\n script_version(\"2020-05-06T07:10:15+0000\");\n script_tag(name:\"last_modification\", value:\"2020-05-06 07:10:15 +0000 (Wed, 06 May 2020)\");\n script_tag(name:\"creation_date\", value:\"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)\");\n script_cve_id(\"CVE-2005-1183\");\n script_bugtraq_id(13213);\n script_xref(name:\"OSVDB\", value:\"15760\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_name(\"MVNForum Search Cross-Site Scripting Vulnerability\");\n script_category(ACT_ATTACK);\n script_family(\"Web application abuses\");\n script_copyright(\"Copyright (C) 2005 Josh Zlatin-Amishav\");\n script_dependencies(\"find_service.nasl\", \"no404.nasl\", \"webmirror.nasl\", \"DDI_Directory_Scanner.nasl\", \"cross_site_scripting.nasl\", \"global_settings.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n\n script_tag(name:\"solution\", value:\"No known solution was made available for at least one year since the disclosure\n of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release,\n disable respective features, remove the product or replace the product by another one.\");\n\n script_tag(name:\"summary\", value:\"The version of mvnForum installed on the remote host is prone to\n cross-site scripting attacks due to its failure to sanitize\n user-supplied input to the search field.\");\n\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\n\nport = http_get_port( default:80 );\n\nhost = http_host_name( dont_add_port:TRUE );\nif( http_get_has_generic_xss( port:port, host:host ) ) exit( 0 );\n\nforeach dir( make_list_unique( \"/\", http_cgi_dirs( port:port ) ) ) {\n\n if( dir == \"/\" ) dir = \"\";\n url = dir + \"/search=%3Cscript%3Ealert('XSS')%3C/script%3E\";\n\n if( http_vuln_check( port:port, url:url, pattern:\"matching entry in OnlineMember for '/search=<script>alert\\('XSS'\", check_header:TRUE ) ) {\n report = http_report_vuln_url( port:port, url:url );\n security_message( port:port, data:report );\n exit( 0 );\n }\n}\n\nexit( 99 );\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:13", "bulletinFamily": "software", "cvelist": ["CVE-2005-1183"], "edition": 1, "description": "## Vulnerability Description\nmvnForum contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not properly validate user-supplied input upon submission to the searchprocess script. This could allow a user to create a specially crafted URL that would execute arbitrary code in another user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. An attacker could potentially steal a user's cookie-based authentication data, allowing impersonation or privilege escalation.\n## Solution Description\nUpgrade to version 1.0 RC4_03 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nmvnForum contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not properly validate user-supplied input upon submission to the searchprocess script. This could allow a user to create a specially crafted URL that would execute arbitrary code in another user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. An attacker could potentially steal a user's cookie-based authentication data, allowing impersonation or privilege escalation.\n## References:\nVendor URL: http://www.mvnforum.com/\nVendor Specific Solution URL: http://www.mvnforum.com/mvnforumweb/download.jsp\nVendor Specific News/Changelog Entry: http://www.mvnforum.com/mvnforum/viewthread?thread=2691\nVendor Specific News/Changelog Entry: http://www.mvnforum.com/mvnforumweb/docs/CHANGE.txt\n[Nessus Plugin ID:18359](https://vulners.com/search?query=pluginID:18359)\nISS X-Force ID: 20613\n[CVE-2005-1183](https://vulners.com/cve/CVE-2005-1183)\nBugtraq ID: 13213\n", "modified": "2005-05-19T06:25:37", "published": "2005-05-19T06:25:37", "href": "https://vulners.com/osvdb/OSVDB:16962", "id": "OSVDB:16962", "title": "mvnForum Search Variable XSS", "type": "osvdb", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "nessus": [{"lastseen": "2021-01-20T12:16:05", "description": "The version of mvnForum installed on the remote host is prone to a\ncross-site scripting attack due to its failure to sanitize user-\nsupplied input to the search field.", "edition": 17, "published": "2005-05-23T00:00:00", "title": "mvnForum Search Parameter XSS", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-1183"], "modified": "2005-05-23T00:00:00", "cpe": [], "id": "MVNFORUM_SEARCH_XSS.NASL", "href": "https://www.tenable.com/plugins/nessus/18359", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# This script was written by Josh Zlatin-Amishav <josh at tkos dot co dot il>\n#\n# This script is released under the GNU GPLv2\n#\n\n# Fixed by Tenable:\n# - Improved description\n# - Adjusted XSS regex.\n\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(18359);\n script_version(\"1.19\");\n script_cve_id(\"CVE-2005-1183\");\n script_bugtraq_id(13213);\n\n script_name(english:\"mvnForum Search Parameter XSS\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server contains a CGI script that is susceptible to a\ncross-site scripting attack.\" );\n script_set_attribute(attribute:\"description\", value:\n\"The version of mvnForum installed on the remote host is prone to a\ncross-site scripting attack due to its failure to sanitize user-\nsupplied input to the search field.\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.mvnforum.com/mvnforum/viewthread?thread=3085\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.mvnforum.com/mvnforum/viewthread?thread=2691\" );\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to mvnForum version 1.0.0 RC4_04 or later.\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2005/05/23\");\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2005/05/19\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_end_attributes();\n\n script_summary(english:\"MVNForum Search Cross-Site Scripting Vulnerability\");\n script_category(ACT_ATTACK);\n script_family(english:\"CGI abuses : XSS\");\n script_copyright(english:\"Copyright (C) 2005-2021 Josh Zlatin-Amishav\");\n script_dependencie(\"http_version.nasl\", \"cross_site_scripting.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"global_settings.inc\");\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\n\nport = get_http_port(default:80, embedded:TRUE);\nif(!get_port_state(port))exit(0);\nif ( get_kb_item(string(\"www/\", port, \"/generic_xss\")) ) exit(0);\n\nglobal_var\tport;\n\nfunction check(url)\n{\n local_var req, res;\n\n req = http_get(item:url +\"/search=%3Cscript%3Ealert('XSS')%3C/script%3E\", port:port);\n res = http_keepalive_send_recv(port:port, data:req, bodyonly:TRUE);\n if ( res == NULL ) exit(0);\n if ( \"matching entry in OnlineMember for '/search=<script>alert('XSS'\" >< res )\n {\n security_warning(port);\n\tset_kb_item(name: 'www/'+port+'/XSS', value: TRUE);\n exit(0);\n }\n}\n\nforeach dir (cgi_dirs())\n{\n check(url:dir);\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}]}