CVE-2004-0358 Cross-site scripting (XSS) vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via (1) the mainnews parameter in admin.php, (2) the exp...
MediumCVSS 6.8
EPSS 4.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via (1) the mainnews parameter in admin.php, (2) the expand parameter in admin.php, (3) the id parameter in admin.php, (4) the catid parameter in admin.php, or (5) an unnamed parameter during the newslogo_upload action in admin.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| virtuasystems virtuanews pro | = 1.0 | No fix listed |
| virtuasystems virtuanews pro | = 1.0.1 | No fix listed |
| virtuasystems virtuanews pro | = 1.0.2 | No fix listed |
| virtuasystems virtuanews pro | = 1.0.3 | No fix listed |
References
- 20040307 RE: VirtuaNews Admin Panel 1.0.3 Pro Cross Site Scripting Vulnerabillity exploit mailing-list
- 20040305 VirtuaNews Admin Panel 1.0.3 Pro Cross Site Scripting Vulnerabillity mailing-list
- 9812 exploit vdb-entry
- 9819 exploit vdb-entry
- virtuanews-multiple-xss(15402) vdb-entry