Vulnerabilities > CVE-2005-4072 - Products Input Validation vulnerability in CFMagic

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

PARTIAL

Availability impact

NONE

network

cfmagic

NVD

Published: 2005-12-08

Updated: 2011-03-08

Summary

Cross-site scripting (XSS) vulnerability in CFMagic Magic Forum Personal 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the Words parameter in search_forums.cfm, as used in the "Search For:" field.

Vulnerable Configurations

Part	Description	Count
Application	Cfmagic Cfmagic Magic Forum Personal *	1

References

http://pridels0.blogspot.com/2005/12/magic-forum-personal-sqlxss-vuln.html
http://secunia.com/advisories/17935
http://www.securityfocus.com/bid/15774
http://www.vupen.com/english/advisories/2005/2794