CVE-2007-0146 - Multiple cross-site scripting (XSS) vulnerabilities in Fix and Chips CMS 1.0 allow remote attackers

CVE-2007-0146

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Fix and Chips CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter in (a) delete-announce.php; the (2) Announcement form field in (b) staff.php; the (3) Client Name, (4) Business Name, (5) Street, (6) Address 2, (7) Town/City, (8) Postcode, (9) Phone Number, (10) Email Address and (11) Website Address form fields in (c) new_customer.php; and unspecified fields in (d) search.php and (e) client-results.php.

References

Vulnerable Configurations

cpe:2.3:a:fix_and_chips_computer_services:fix_and_chips_cms:1.0:*:*:*:*:*:*:*
cpe:2.3:a:fix_and_chips_computer_services:fix_and_chips_cms:1.0:*:*:*:*:*:*:*

CVSS

Base:	6.0 (as of 16-10-2018 - 16:31)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	SINGLE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:S/C:P/I:P/A:P

refmap via4

bugtraq	20070106 Fix & Chips CMS v1.0
osvdb	32646 32647 32648 32649 32650
secunia	23625
sreason	2119
vupen	ADV-2007-0081
xf	fixandchips-multiple-scripts-xss(31319)

Last major update

16-10-2018 - 16:31

Published

09-01-2007 - 18:28

Last modified

16-10-2018 - 16:31