PT-2007-2669 · Built2Go · Built2Go News Manager Blog

The_3Dit0R · Published 2007-03-03 · Updated 2018-10-16 · CVE-2007-1248

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions built2go News Manager Blog version 1.0

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the cid, uid, and nid parameters to "news.php", and the nid parameter to "rating.php".

Recommendations For built2go News Manager Blog version 1.0, consider restricting access to the "news.php" and "rating.php" endpoints until a fix is available. As a temporary workaround, avoid using the cid, uid, and nid parameters in the affected API endpoints.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-1248

Affected Products

Built2Go News Manager Blog

References · 9

• 🔥 https://exploit-db.com/exploits/29697 · Exploit
• 🔥 http://securityfocus.com/bid/22783 · Exploit
• 🔥 https://exploit-db.com/exploits/29698 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1248 · Security Note
• http://secunia.com/advisories/24334 · Vendor Advisory
• http://securityreason.com/securityalert/2343 · Note
• http://securityfocus.com/archive/1/461672/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32772 · Note
• http://vupen.com/english/advisories/2007/0818 · Note