CVE-2005-4041

Cross-site scripting (XSS) vulnerability in search.cgi in MR CGI Guy Hot Links SQL 3.1.x and Hot Links Pro 3.1.x allows remote attackers to inject arbitrary web script or HTML via the query string.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/17872	Vendor Advisory
http://secunia.com/advisories/17868	Vendor Advisory
http://www.securityfocus.com/bid/15708
http://pridels0.blogspot.com/2005/12/hot-links-sql-3x-xss-vuln.html
http://pridels0.blogspot.com/2005/12/hot-links-pro-3x-xss-vuln.html
http://www.vupen.com/english/advisories/2005/2737
http://www.vupen.com/english/advisories/2005/2736

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mr._cgi_guy:hot_links_pro::::::::
	cpe:2.3:a:mr._cgi_guy:hot_links_sql::::::::

Information

Published : 2005-12-06 03:03

Updated : 2011-03-07 18:27

NVD link : CVE-2005-4041

Mitre link : CVE-2005-4041

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

mr._cgi_guy

hot_links_sql
hot_links_pro

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secunia.com/advisories/17872", "name": "17872", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://secunia.com/advisories/17868", "name": "17868", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/15708", "name": "15708", "tags": [], "refsource": "BID"}, {"url": "http://pridels0.blogspot.com/2005/12/hot-links-sql-3x-xss-vuln.html", "name": "http://pridels0.blogspot.com/2005/12/hot-links-sql-3x-xss-vuln.html", "tags": [], "refsource": "MISC"}, {"url": "http://pridels0.blogspot.com/2005/12/hot-links-pro-3x-xss-vuln.html", "name": "http://pridels0.blogspot.com/2005/12/hot-links-pro-3x-xss-vuln.html", "tags": [], "refsource": "MISC"}, {"url": "http://www.vupen.com/english/advisories/2005/2737", "name": "ADV-2005-2737", "tags": [], "refsource": "VUPEN"}, {"url": "http://www.vupen.com/english/advisories/2005/2736", "name": "ADV-2005-2736", "tags": [], "refsource": "VUPEN"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in search.cgi in MR CGI Guy Hot Links SQL 3.1.x and Hot Links Pro 3.1.x allows remote attackers to inject arbitrary web script or HTML via the query string."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-4041", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2005-12-06T11:03Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:mr._cgi_guy:hot_links_pro:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.0"}, {"cpe23Uri": "cpe:2.3:a:mr._cgi_guy:hot_links_sql:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.1.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2011-03-08T02:27Z"}