Vulnerabilities > CVE-2006-0923 - Cross-Site Scripting vulnerability in MyPHPNuke
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
NONE Integrity impact
PARTIAL Availability impact
NONE Summary
Multiple cross-site scripting (XSS) vulnerabilities in MyPHPNuke (MPN) 1.88 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the letter parameter in reviews.php and (2) the dcategory parameter in download.php.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 3 |
Exploit-Db
description myPHPNuke 1.8.8 download.php dcategory Parameter XSS. CVE-2006-0923. Webapps exploit for php platform id EDB-ID:27309 last seen 2016-02-03 modified 2006-02-22 published 2006-02-22 reporter Mustafa Can Bjorn source https://www.exploit-db.com/download/27309/ title myPHPNuke 1.8.8 download.php dcategory Parameter XSS description myPHPNuke 1.8.8 reviews.php letter Parameter XSS. CVE-2006-0923. Webapps exploit for php platform id EDB-ID:27308 last seen 2016-02-03 modified 2006-02-22 published 2006-02-22 reporter Mustafa Can Bjorn source https://www.exploit-db.com/download/27308/ title myPHPNuke 1.8.8 reviews.php letter Parameter XSS
References
- http://secunia.com/advisories/19052
- http://securityreason.com/securityalert/491
- http://www.myphpnuke.com/article.php?sid=1035&mode=thread&order=0
- http://www.nukedx.com/?viewdoc=12
- http://www.securityfocus.com/archive/1/425983/100/0/threaded
- http://www.securityfocus.com/bid/16815
- http://www.vupen.com/english/advisories/2006/0750
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24887