CVE-2006-3533 Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) fg, (2) l...
MediumCVSS 5.8
EPSS 6.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) fg, (2) line1, (3) line2, (4) bg, (5) c1, (6) c2, (7) c3, and (8) c4 parameters in (a) includes/blogroll.php; (9) name and (10) js_name parameters in (b) includes/editor/edit_menu.php; and, even if register_globals is not enabled, the (11) h and (12) w parameters in (c) includes/photo.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pivot | = 1.30_rc2 | No fix listed |
References
- retrogod.altervista.org exploit
- 20962 third-party-advisory vendor-advisory
- 1214 third-party-advisory
- 27127 vdb-entry
- 27128 vdb-entry
- 27129 vdb-entry
- 20060707 Pivot <=1.30rc2 privilege escalation / remote commands execution mailing-list
- 18881 exploit vdb-entry
- ADV-2006-2744 vdb-entry
- pivot-multiple-scripts-xss(27672) vdb-entry