CVE-2005-1782
published 2005-05-26CVE-2005-1782: Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node parameter…
PriorityP421medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
5.13%
91.3th percentile
Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node parameter to (1) add_review.htm, (2) suggest_review.htm, (3) suggest_category.htm, (4) add_booklist.htm, or (5) add_url.htm, the isbn parameter to (6) add_review.htm, (7) add_contents.htm, (8) add_classification.htm, the (9) chapters parameter to the add_contents page in index.php (aka add_contents.htm), (10) the user parameter to contact.htm, or (11) the submit[string] parameter to search.htm. NOTE: it is not clear whether BookReview is available to the public. If not, then it should not be included in CVE.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| w.m.r_simpson | bookreview | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
BookReview 1.0 - 'add_review.htm' Multiple Cross-Site Scripting Vulnerabilities
exploitdb·2005-05-26
CVE-2005-1782 BookReview 1.0 - 'add_review.htm' Multiple Cross-Site Scripting Vulnerabilities
BookReview 1.0 - 'add_review.htm' Multiple Cross-Site Scripting Vulnerabilities
---
source: https://www.securityfocus.com/bid/13783/info
BookReview is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
http://www.example.com/add_review.htm?isbn=0801052319&node=%3Cscript%3Ealert(document.cookie)%3C/script%3E&review=true
http://www.example.com/add_review.htm?isbn=0801052319%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&node=Political_Science&review=true
http://www.examp
Exploit-DB
BookReview 1.0 - 'suggest_review.htm?node' Cross-Site Scripting
exploitdb·2005-05-26
CVE-2005-1782 BookReview 1.0 - 'suggest_review.htm?node' Cross-Site Scripting
BookReview 1.0 - 'suggest_review.htm?node' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/13783/info
BookReview is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
http://www.example.com/suggest_review.htm?node=Business_and_Economics">alert()
Exploit-DB
BookReview 1.0 - 'add_contents.htm' Multiple Cross-Site Scripting Vulnerabilities
exploitdb·2005-05-26
CVE-2005-1782 BookReview 1.0 - 'add_contents.htm' Multiple Cross-Site Scripting Vulnerabilities
BookReview 1.0 - 'add_contents.htm' Multiple Cross-Site Scripting Vulnerabilities
---
source: https://www.securityfocus.com/bid/13783/info
BookReview is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
http://www.example.com/add_contents.htm?isbn=083081423X%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB
BookReview 1.0 - 'add_booklist.htm?node' Cross-Site Scripting
exploitdb·2005-05-26
CVE-2005-1782 BookReview 1.0 - 'add_booklist.htm?node' Cross-Site Scripting
BookReview 1.0 - 'add_booklist.htm?node' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/13783/info
BookReview is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
http://www.example.com/add_booklist.htm?node=Agriculture_and_Aquaculture%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB
BookReview 1.0 - 'contact.htm?user' Cross-Site Scripting
exploitdb·2005-05-26
CVE-2005-1782 BookReview 1.0 - 'contact.htm?user' Cross-Site Scripting
BookReview 1.0 - 'contact.htm?user' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/13783/info
BookReview is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
http://www.example.com/contact.htm?user=admin%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB
BookReview 1.0 - 'search.htm?submit string' Cross-Site Scripting
exploitdb·2005-05-26
CVE-2005-1782 BookReview 1.0 - 'search.htm?submit string' Cross-Site Scripting
BookReview 1.0 - 'search.htm?submit string' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/13783/info
BookReview is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
http://www.example.com/search.htm?page=search&submit%5Bstring%5D=%5C%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&submit=Ok&submit%5Btype%5D=author
Exploit-DB
BookReview 1.0 - 'add_url.htm?node' Cross-Site Scripting
exploitdb·2005-05-26
CVE-2005-1782 BookReview 1.0 - 'add_url.htm?node' Cross-Site Scripting
BookReview 1.0 - 'add_url.htm?node' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/13783/info
BookReview is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
http://www.example.com/add_url.htm?node=%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB
BookReview 1.0 - 'suggest_category.htm?node' Cross-Site Scripting
exploitdb·2005-05-26
CVE-2005-1782 BookReview 1.0 - 'suggest_category.htm?node' Cross-Site Scripting
BookReview 1.0 - 'suggest_category.htm?node' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/13783/info
BookReview is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
http://www.example.com/suggest_category.htm?node=Agriculture%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB
BookReview 1.0 - 'add_classification.htm?isbn' Cross-Site Scripting
exploitdb·2005-05-26
CVE-2005-1782 BookReview 1.0 - 'add_classification.htm?isbn' Cross-Site Scripting
BookReview 1.0 - 'add_classification.htm?isbn' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/13783/info
BookReview is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
http://www.example.com/add_classification.htm?isbn=0830815961%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&node=Gospels
No writeups or analysis indexed.
http://lostmon.blogspot.com/2005/05/bookreview-10-multiple-variable-xss.htmlhttp://securitytracker.com/id?1014058http://www.osvdb.org/16871http://www.osvdb.org/16872http://www.osvdb.org/16873http://www.osvdb.org/16874http://www.osvdb.org/16875http://www.osvdb.org/16876http://www.osvdb.org/16877http://www.osvdb.org/16878http://www.osvdb.org/16879http://www.securityfocus.com/bid/13783http://lostmon.blogspot.com/2005/05/bookreview-10-multiple-variable-xss.htmlhttp://securitytracker.com/id?1014058http://www.osvdb.org/16871http://www.osvdb.org/16872http://www.osvdb.org/16873http://www.osvdb.org/16874http://www.osvdb.org/16875http://www.osvdb.org/16876http://www.osvdb.org/16877http://www.osvdb.org/16878http://www.osvdb.org/16879http://www.securityfocus.com/bid/13783
2005-05-26
Published