Vulnerability CVE-2015-1435


Published: 2015-02-16   Modified: 2017-09-07

Description:
Cross-site scripting (XSS) vulnerability in my little forum before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the back parameter to index.php.

Vendor: Mylittleforum
Product: My little forum 
Version: 2.3.3;

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None

 References:
http://mylittleforum.net/forum/index.php?id=8182
http://packetstormsecurity.com/files/130356/My-Little-Forum-2.3.3-Cross-Site-Scripting-SQL-Injection.html
http://www.securityfocus.com/archive/1/archive/1/534681/100/0/threaded
http://www.securityfocus.com/bid/72582
https://exchange.xforce.ibmcloud.com/vulnerabilities/100856
https://www.htbridge.com/advisory/HTB23248

Related CVE
CVE-2015-1434
Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the (1) letter parameter in a user action or (2) edit_category parameter to index.php.
CVE-2015-1475
Multiple cross-site scripting (XSS) vulnerabilities in my little forum 2.3.3, 2.2, and 1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) category parameter to forum.php or the (3) page or (4) order parameter to...
CVE-2010-2133
SQL injection vulnerability in contact.php in My Little Forum allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2007-2942.

Copyright 2017, cxsecurity.com

 

Back to Top