CVE-2006-2178

Multiple cross-site scripting (XSS) vulnerabilities in CyberBuild allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to login.asp, (2) ProductIndex parameter to browse0.htm, (3) rowcolor parameter to result.asp, or (4) heading parameter to result.asp. NOTE: vectors 1 and 2 might be resultant from SQL injection.

CVSS v2.0 5.8 MEDIUM

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://pridels0.blogspot.com/2006/05/cyberbuild-vuln.html
http://secunia.com/advisories/19889	Vendor Advisory
http://www.osvdb.org/25197	Exploit
http://www.osvdb.org/25198	Exploit
http://www.osvdb.org/25199	Exploit
http://www.securityfocus.com/bid/17829	Exploit
http://www.vupen.com/english/advisories/2006/1630	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/26202

Configurations

Configuration 1 (hide)

cpe:2.3:a:smartwin_technology:cyberoffice_warehouse_builder:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2006-05-04 12:38

Updated : 2024-02-04 16:52

NVD link : CVE-2006-2178

Mitre link : CVE-2006-2178

CVE.ORG link : CVE-2006-2178

JSON object : View

Products Affected

smartwin_technology

cyberoffice_warehouse_builder

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2006-2178", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2006-05-04T12:38:00.000", "references": [{"url": "http://pridels0.blogspot.com/2006/05/cyberbuild-vuln.html", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/19889", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/25197", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/25198", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/25199", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/17829", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/1630", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26202", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in CyberBuild allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to login.asp, (2) ProductIndex parameter to browse0.htm, (3) rowcolor parameter to result.asp, or (4) heading parameter to result.asp. NOTE: vectors 1 and 2 might be resultant from SQL injection."}], "lastModified": "2017-07-20T01:31:14.957", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:smartwin_technology:cyberoffice_warehouse_builder:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F8A8353-1CFE-42FB-B380-E37AEF76EE79"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}