Detections
Analytics
CuteNews show_archives.php archive Parameter XSS
medium Nessus Plugin ID 14318
Language:
Synopsis
The remote web server contains a PHP script that is affected by a cross-site scripting vulnerability.Description
According to its banner, the version of CuteNews on the remote host is affected by a cross-site scripting (XSS) vulnerability due to a failure to sanitize input to the 'archive' parameter of the show_archives.php script. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session.Solution
Upgrade to CuteNews v1.3.2 or later.See Also
https://secuniaresearch.flexerasoftware.com/advisories/12260/
Plugin Details
Severity: Medium
ID: 14318
File Name: cutenews_xss.nasl
Version: 1.29
Type: remote
Family: CGI abuses : XSS
Published: 8/20/2004
Updated: 1/19/2021
Supported Sensors: Nessus
Vulnerability Information
Required KB Items: www/cutenews
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 8/16/2004
Reference Information
BID: 10948