CVE-2004-1871

Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ppuser, (2) password, (3) stype, (4) perpage, (5) sort, (6) page, (7) si, or (8) cat parameters to showmembers.php, or the (9) photo name, (10) photo description, (11) album name, or (12) album description fields.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://marc.info/?l=bugtraq&m=108057790723123&w=2
http://secunia.com/advisories/11241	Exploit Patch Vendor Advisory
http://securitytracker.com/id?1009571	Vendor Advisory
http://www.gulftech.org/03282004.php
http://www.securityfocus.com/bid/9994	Exploit Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15643

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:photopost:photopost_php_pro:3.1:::::::*
	cpe:2.3:a:photopost:photopost_php_pro:3.2:::::::*
	cpe:2.3:a:photopost:photopost_php_pro:3.3:::::::*
	cpe:2.3:a:photopost:photopost_php_pro:4.0:::::::*
	cpe:2.3:a:photopost:photopost_php_pro:4.1:::::::*
	cpe:2.3:a:photopost:photopost_php_pro:4.6:::::::*
	cpe:2.3:a:photopost:photopost_php_pro:4.8.1:::::::*

History

No history.

Information

Published : 2004-03-29 05:00

Updated : 2017-07-11 01:31

NVD link : CVE-2004-1871

Mitre link : CVE-2004-1871

CVE.ORG link : CVE-2004-1871

JSON object : View

Products Affected

photopost

photopost_php_pro

CWE

NVD-CWE-Other

{"id": "CVE-2004-1871", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2004-03-29T05:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=108057790723123&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/11241", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1009571", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.gulftech.org/03282004.php", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/9994", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15643", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ppuser, (2) password, (3) stype, (4) perpage, (5) sort, (6) page, (7) si, or (8) cat parameters to showmembers.php, or the (9) photo name, (10) photo description, (11) album name, or (12) album description fields."}], "lastModified": "2017-07-11T01:31:25.450", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:photopost:photopost_php_pro:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2C8CE03-944A-480E-9349-9143A74ADCBB"}, {"criteria": "cpe:2.3:a:photopost:photopost_php_pro:3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "762D922E-387C-41D6-BA4B-9D97692B7570"}, {"criteria": "cpe:2.3:a:photopost:photopost_php_pro:3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D07B06C-3872-4D39-95FA-C0FAEBD9C2DD"}, {"criteria": "cpe:2.3:a:photopost:photopost_php_pro:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C36E11FE-5E1F-4BF9-A223-64B74984C5DE"}, {"criteria": "cpe:2.3:a:photopost:photopost_php_pro:4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D19ECFF-EAE7-4FCB-BE21-B0C08FF65AAC"}, {"criteria": "cpe:2.3:a:photopost:photopost_php_pro:4.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8F04E77C-C9ED-4CAE-964C-6AB395BFEBE4"}, {"criteria": "cpe:2.3:a:photopost:photopost_php_pro:4.8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8DEC786-BC61-44F7-8B93-3ECDA07C0772"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}