CVE-2008-6359

Cross-site scripting (XSS) vulnerability in index.php in Max's Guestbook allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) email, and (3) message parameters.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/33106	Vendor Advisory
http://www.securityfocus.com/bid/32763
http://osvdb.org/50654
https://exchange.xforce.ibmcloud.com/vulnerabilities/47250
https://exchange.xforce.ibmcloud.com/vulnerabilities/74011
http://www.securityfocus.com/bid/52471
http://www.exploit-db.com/exploits/18595
http://packetstormsecurity.org/files/110772/Maxs-Guestbook-1.0-Local-File-Inclusion-Path-Disclosure.html
http://www.securityfocus.com/archive/1/499099/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:phpf1:max\'s_guestbook:-:*:*:*:*:*:*:*

Information

Published : 2009-03-02 08:30

Updated : 2018-10-11 13:57

NVD link : CVE-2008-6359

Mitre link : CVE-2008-6359

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

phpf1

max\'s_guestbook

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secunia.com/advisories/33106", "name": "33106", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/32763", "name": "32763", "tags": [], "refsource": "BID"}, {"url": "http://osvdb.org/50654", "name": "50654", "tags": [], "refsource": "OSVDB"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47250", "name": "maxsguestbook-index-xss(47250)", "tags": [], "refsource": "XF"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74011", "name": "maxguestbook-name-xss(74011)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/bid/52471", "name": "52471", "tags": [], "refsource": "BID"}, {"url": "http://www.exploit-db.com/exploits/18595", "name": "18595", "tags": [], "refsource": "EXPLOIT-DB"}, {"url": "http://packetstormsecurity.org/files/110772/Maxs-Guestbook-1.0-Local-File-Inclusion-Path-Disclosure.html", "name": "http://packetstormsecurity.org/files/110772/Maxs-Guestbook-1.0-Local-File-Inclusion-Path-Disclosure.html", "tags": [], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/archive/1/499099/100/0/threaded", "name": "20081210 Max's Guestbook (XSS) Remote Vulnerability", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in index.php in Max's Guestbook allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) email, and (3) message parameters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2008-6359", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2009-03-02T16:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:phpf1:max\\'s_guestbook:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-11T20:57Z"}