CANews Multiple Vulnerabilities

------------------------------------------------------------------ - CANews Remote Multiple Vulnerability - -= http://colander.altervista.org/advisory/CANews.txt =- ------------------------------------------------------------------ -= CodeAvalanche News Version 1.2 =- Omnipresent May 18, 2006...

CVE-2006-2500

CANews 1.2 is affected by a Cross-Site Scripting (XSS) vulnerability in add_news.asp where the Headline field accepts input that can inject arbitrary script/HTML. The root cause is insufficient input sanitization for that field, enabling remote attackers to execute script in a victim’s browser. T...

CVE-2006-2499

CVE-2006-2499 affects CodeAvalanche News (CANews) 1.2, where a SQL injection in default.asp via the password field allows remote execution of arbitrary SQL. The linked data list a CVSSv2 base score of 7.5 (HIGH) with NETWORK attack vector, LOW access complexity, and no authentication required, yi...