CVE-2007-4589 Multiple cross-site scripting (XSS) vulnerabilities in InterWorx Hosting Control Panel (InterWorx-CP) Webmaster Level (SiteWorx) 3.0.2 (1) allow remote attackers to inject arbitrary web script or HTML...
MediumCVSS 4.3
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in InterWorx Hosting Control Panel (InterWorx-CP) Webmaster Level (SiteWorx) 3.0.2 (1) allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php; and allow remote authenticated users to inject arbitrary web script or HTML via the PATH_INFO to (2) siteworx.php, (3) users.php, (4) ftp.php, (5) mysql.php, (6) domains.php, (7) htaccess.php, (8) scriptworx.php, (9) stats.php, (10) backup.php, (11) restore.php, and (12) httpd.php; and unspecified vectors to (13) cron.php and (14) prefs.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| interworx web control panel | = 3.0.2 | No fix listed |
References
- interworx.com
- 36767 vdb-entry
- 36768 vdb-entry
- 36769 vdb-entry
- 36770 vdb-entry
- 36771 vdb-entry
- 36772 vdb-entry
- 36773 vdb-entry
- 36774 vdb-entry
- 36775 vdb-entry
- 36776 vdb-entry
- 36777 vdb-entry
- 36778 vdb-entry
- 36779 vdb-entry
- 36780 vdb-entry
- 26586 third-party-advisory
- 3070 third-party-advisory
- www.hackerscenter.com
- 20070826 InterWorx-CP Multiple HTML Injections Vulnerabilitie mailing-list
- 25451 vdb-entry
- interworxcp-index-xss(36297) vdb-entry
- interworx-siteworx-multiple-file-include(36300) vdb-entry