{"lastseen": "2020-04-01T19:04:19", "references": [], "description": "\nHiveMail 1.2.21.3 - index.php $_SERVER[PHP_SELF] Cross-Site Scripting", "edition": 1, "reporter": "GulfTech Security", "exploitpack": {"type": "webapps", "platform": "php"}, "published": "2006-02-11T00:00:00", "title": "HiveMail 1.2.21.3 - index.php $_SERVER[PHP_SELF] Cross-Site Scripting", "type": "exploitpack", "enchantments": {"dependencies": {"references": [], "modified": "2020-04-01T19:04:19", "rev": 2}, "score": {"value": 0.0, "vector": "NONE", "modified": "2020-04-01T19:04:19", "rev": 2}, "vulnersScore": 0.0}, "bulletinFamily": "exploit", "cvelist": [], "modified": "2006-02-11T00:00:00", "id": "EXPLOITPACK:9840FC011BF585845E92F02FE35DAB3F", "href": "", "viewCount": 1, "sourceData": "source: https://www.securityfocus.com/bid/16591/info\n \nHiveMail is prone to multiple vulnerabilities. These vulnerabilities may allow the execution of arbitrary PHP code, cross-site scripting attacks, and SQL injection.\n \nThe PHP code-execution issues are the result of an input-validation error that may allow user-supplied PHP code to be evaluated by the interpreter.\n \nThe cross-site scripting vulnerabilities may permit a remote attacker to steal cookie-based authentication credentials from legitimate users.\n \nThe SQL-injection issues are the result of the application's failure to properly sanitize user-supplied input that will be included in SQL queries. Successful exploitation of SQL-injection vulnerabilities could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. \n\nhttp://www.example.com/index.php/%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E", "cvss": {"score": 0.0, "vector": "NONE"}}

{}