CVE-2007-1606
published 2007-03-22CVE-2007-1606: Multiple cross-site scripting (XSS) vulnerabilities in w-Agora (Web-Agora) allow remote attackers to inject arbitrary web script or HTML via (1) the showuser…
PriorityP418medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
2.00%
78.3th percentile
Multiple cross-site scripting (XSS) vulnerabilities in w-Agora (Web-Agora) allow remote attackers to inject arbitrary web script or HTML via (1) the showuser parameter to profile.php, the (2) search_forum or (3) search_user parameter to search.php, or (4) the userid parameter to change_password.php.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| w-agora | w-agora | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
W-Agora 4.2.1 - 'profile.php?showuser' Cross-Site Scripting
exploitdb·2007-03-20
CVE-2007-1606 W-Agora 4.2.1 - 'profile.php?showuser' Cross-Site Scripting
W-Agora 4.2.1 - 'profile.php?showuser' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/23057/info
w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
w-Agora 4.2.1 is vulnerable.
http://www.example.com/w-agora/profile.php?site=hello&showuser='">alert(document.cookie)
Exploit-DB
W-Agora 4.2.1 - 'search.php?search_user' Cross-Site Scripting
exploitdb·2007-03-20
CVE-2007-1606 W-Agora 4.2.1 - 'search.php?search_user' Cross-Site Scripting
W-Agora 4.2.1 - 'search.php?search_user' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/23057/info
w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
w-Agora 4.2.1 is vulnerable.
http://www.example.com/w-agora/search.php?bn=hello_hello&gosearch=1&pattern=1&search_date=0&search_fields[body]=1&search_fields[ subject]=1&search_forum=hello_hello&search_mode=0&search_user='">alert(document.cook
Exploit-DB
W-Agora 4.2.1 - 'change_password.php?userid' Cross-Site Scripting
exploitdb·2007-03-20
CVE-2007-1606 W-Agora 4.2.1 - 'change_password.php?userid' Cross-Site Scripting
W-Agora 4.2.1 - 'change_password.php?userid' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/23057/info
w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
w-Agora 4.2.1 is vulnerable.
http://www.example.com/w-agora/change_password.php?newpasswd1=1&newpasswd2=1&passwd=1&site=hello&userid='">alert(documen t.cookie)
No writeups or analysis indexed.
http://osvdb.org/34377http://osvdb.org/34378http://osvdb.org/34379http://secunia.com/advisories/24605http://securityreason.com/securityalert/2462http://www.securityfocus.com/archive/1/463286/100/0/threadedhttp://www.securityfocus.com/bid/23057https://exchange.xforce.ibmcloud.com/vulnerabilities/33175http://osvdb.org/34377http://osvdb.org/34378http://osvdb.org/34379http://secunia.com/advisories/24605http://securityreason.com/securityalert/2462http://www.securityfocus.com/archive/1/463286/100/0/threadedhttp://www.securityfocus.com/bid/23057https://exchange.xforce.ibmcloud.com/vulnerabilities/33175
2007-03-22
Published