{"href": "https://vulners.com/osvdb/OSVDB:35366", "id": "OSVDB:35366", "reporter": "the_Edit0r(the_3dit0r@yahoo.com)", "published": "2007-04-12T13:14:17", "description": "## Vulnerability Description\nphpwebnews contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'm_txt' variable upon submission to index.php. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nphpwebnews contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'm_txt' variable upon submission to index.php. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Manual Testing Notes\nhttp://[target]/[path]/index.php?m_txt=<script>alert(/the_Edit0r/);</script>\n## References:\nVendor URL: http://sourceforge.net/project/showfiles.php?group_id=111998\n[Related OSVDB ID: 35367](https://vulners.com/osvdb/OSVDB:35367)\n[Related OSVDB ID: 35365](https://vulners.com/osvdb/OSVDB:35365)\n[Related OSVDB ID: 35366](https://vulners.com/osvdb/OSVDB:35366)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-04/0199.html\nISS X-Force ID: 33641\n[CVE-2007-2300](https://vulners.com/cve/CVE-2007-2300)\nBugtraq ID: 23448\n", "title": "phpwebnews index.php m_txt Variable XSS", "lastseen": "2017-04-28T13:20:31", "bulletinFamily": "software", "type": "osvdb", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "references": [], "edition": 1, "cvelist": ["CVE-2007-2300"], "affectedSoftware": [{"name": "phpwebnews", "operator": "eq", "version": "0.1"}, {"name": "phpwebnews", "operator": "eq", "version": "0.2"}], "viewCount": 3, "enchantments": {"score": {"value": 5.2, "vector": "NONE", "modified": "2017-04-28T13:20:31", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2007-2300"]}, {"type": "osvdb", "idList": ["OSVDB:35365", "OSVDB:35367"]}, {"type": "exploitdb", "idList": ["EDB-ID:29846", "EDB-ID:29847", "EDB-ID:29845"]}], "modified": "2017-04-28T13:20:31", "rev": 2}, "vulnersScore": 5.2}, "modified": "2007-04-12T13:14:17"}

{"cve": [{"lastseen": "2021-02-02T05:31:23", "description": "Multiple cross-site scripting (XSS) vulnerabilities in Endy Kristanto Surat kabar / News Management Online (aka phpwebnews) 0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the m_txt parameter to (1) iklan.php, (2) index.php, or (3) bukutamu.php.", "edition": 4, "cvss3": {}, "published": "2007-04-26T21:19:00", "title": "CVE-2007-2300", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-2300"], "modified": "2018-10-16T16:43:00", "cpe": ["cpe:/a:surat_kabar:phpwebnews:0.2", "cpe:/a:surat_kabar:phpwebnews:0.1"], "id": "CVE-2007-2300", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-2300", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:surat_kabar:phpwebnews:0.2:*:*:*:*:*:*:*", "cpe:2.3:a:surat_kabar:phpwebnews:0.1:*:*:*:*:*:*:*"]}], "osvdb": [{"lastseen": "2017-04-28T13:20:31", "bulletinFamily": "software", "cvelist": ["CVE-2007-2300"], "description": "## Vulnerability Description\nphpwebnews contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'm_txt' variable upon submission to iklan.php. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nphpwebnews contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'm_txt' variable upon submission to iklan.php. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Manual Testing Notes\nhttp://[target]/[path]/iklan.php?m_txt=<script>alert(/the_Edit0r/);</script>\n## References:\nVendor URL: http://sourceforge.net/project/showfiles.php?group_id=111998\n[Related OSVDB ID: 35367](https://vulners.com/osvdb/OSVDB:35367)\n[Related OSVDB ID: 35366](https://vulners.com/osvdb/OSVDB:35366)\n[Related OSVDB ID: 35365](https://vulners.com/osvdb/OSVDB:35365)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-04/0199.html\nISS X-Force ID: 33641\n[CVE-2007-2300](https://vulners.com/cve/CVE-2007-2300)\nBugtraq ID: 23448\n", "edition": 1, "modified": "2007-04-12T13:14:17", "published": "2007-04-12T13:14:17", "href": "https://vulners.com/osvdb/OSVDB:35365", "id": "OSVDB:35365", "title": "phpwebnews iklan.php m_txt Variable XSS", "type": "osvdb", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-04-28T13:20:31", "bulletinFamily": "software", "cvelist": ["CVE-2007-2300"], "description": "## Vulnerability Description\nphpwebnews contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'm_txt' variable upon submission to bukutamu.php. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nphpwebnews contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'm_txt' variable upon submission to bukutamu.php. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Manual Testing Notes\nhttp://[target]/[path]/bukutamu.php?m_txt=<script>alert(/the_Edit0r/);</script>\n## References:\nVendor URL: http://sourceforge.net/project/showfiles.php?group_id=111998\n[Related OSVDB ID: 35365](https://vulners.com/osvdb/OSVDB:35365)\n[Related OSVDB ID: 35366](https://vulners.com/osvdb/OSVDB:35366)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-04/0199.html\nISS X-Force ID: 33641\n[CVE-2007-2300](https://vulners.com/cve/CVE-2007-2300)\nBugtraq ID: 23448\n", "edition": 1, "modified": "2007-04-12T13:14:17", "published": "2007-04-12T13:14:17", "href": "https://vulners.com/osvdb/OSVDB:35367", "id": "OSVDB:35367", "title": "phpwebnews bukutamu.php m_txt Variable XSS", "type": "osvdb", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "exploitdb": [{"lastseen": "2016-02-03T11:14:56", "description": "phpwebnews 0.1 iklan.php m_txt Parameter XSS. CVE-2007-2300. Webapps exploit for php platform", "published": "2007-04-07T00:00:00", "type": "exploitdb", "title": "phpwebnews 0.1 iklan.php m_txt Parameter XSS", "bulletinFamily": "exploit", "cvelist": ["CVE-2007-2300"], "modified": "2007-04-07T00:00:00", "id": "EDB-ID:29845", "href": "https://www.exploit-db.com/exploits/29845/", "sourceData": "source: http://www.securityfocus.com/bid/23448/info\r\n\r\nThe 'phpwebnews' package is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.\r\n\r\nAn attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.\r\n\r\nThis issue affects phpwebnews 0.1; other versions may also be affected. \r\n\r\nhttp://www.example.com/[path]/iklan.php?m_txt=[xss]", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/29845/"}, {"lastseen": "2016-02-03T11:15:05", "description": "phpwebnews 0.1 index.php m_txt Parameter XSS. CVE-2007-2300. Webapps exploit for php platform", "published": "2007-04-07T00:00:00", "type": "exploitdb", "title": "phpwebnews 0.1 index.php m_txt Parameter XSS", "bulletinFamily": "exploit", "cvelist": ["CVE-2007-2300"], "modified": "2007-04-07T00:00:00", "id": "EDB-ID:29846", "href": "https://www.exploit-db.com/exploits/29846/", "sourceData": "source: http://www.securityfocus.com/bid/23448/info\r\n \r\nThe 'phpwebnews' package is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.\r\n \r\nAn attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.\r\n \r\nThis issue affects phpwebnews 0.1; other versions may also be affected. \r\n\r\nhttp://www.example.com/[path]/index.php?m_txt=[xss]", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/29846/"}, {"lastseen": "2016-02-03T11:15:15", "description": "phpwebnews 0.1 bukutamu.php m_txt Parameter XSS. CVE-2007-2300. Webapps exploit for php platform", "published": "2007-04-07T00:00:00", "type": "exploitdb", "title": "phpwebnews 0.1 bukutamu.php m_txt Parameter XSS", "bulletinFamily": "exploit", "cvelist": ["CVE-2007-2300"], "modified": "2007-04-07T00:00:00", "id": "EDB-ID:29847", "href": "https://www.exploit-db.com/exploits/29847/", "sourceData": "source: http://www.securityfocus.com/bid/23448/info\r\n \r\nThe 'phpwebnews' package is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.\r\n \r\nAn attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.\r\n \r\nThis issue affects phpwebnews 0.1; other versions may also be affected. \r\n\r\nhttp://www.example.com/[path]/bukutamu.php?m_txt=[xss] ", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/29847/"}]}