CVE-2007-5304 - Vulnerability Details - OpenCVE

Multiple cross-site scripting (XSS) vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) repertimage parameter to utilisateurs/vousetesbannis.php, the (2) elseifvotetxtresultatduvote parameter to utilisateurs/votesresultats.php, and the (3) elseifforumtxtmenugeneraleduforum parameter to moduleajouter/depot/adminforum.php.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Yannick Tanguy	Else If Cms

Configuration 1 [-]

cpe:2.3:a:yannick_tanguy:else_if_cms:0.6-beta:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://osvdb.org/38646
http://osvdb.org/38647
http://osvdb.org/38648
http://securityreason.com/securityalert/3204
http://www.securityfocus.com/archive/1/481683/100/0/threaded
http://www.securityfocus.com/bid/25951
http://www.vupen.com/english/advisories/2007/3429
https://exchange.xforce.ibmcloud.com/vulnerabilities/37007

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-10-09T18:00:00

Updated: 2024-08-07T15:24:42.424Z

Reserved: 2007-10-09T00:00:00

Link: CVE-2007-5304

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-10-09T18:17:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-5304

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-10-06T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) repertimage parameter to utilisateurs/vousetesbannis.php, the (2) elseifvotetxtresultatduvote parameter to utilisateurs/votesresultats.php, and the (3) elseifforumtxtmenugeneraleduforum parameter to moduleajouter/depot/adminforum.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-15T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "38646", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/38646"}, {"name": "38648", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/38648"}, {"name": "25951", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/25951"}, {"name": "38647", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/38647"}, {"name": "ADV-2007-3429", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/3429"}, {"name": "elseif-multiple-xss(37007)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37007"}, {"name": "20071006 Else If cms Multiple Remote vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/481683/100/0/threaded"}, {"name": "3204", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/3204"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-5304", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site scripting (XSS) vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) repertimage parameter to utilisateurs/vousetesbannis.php, the (2) elseifvotetxtresultatduvote parameter to utilisateurs/votesresultats.php, and the (3) elseifforumtxtmenugeneraleduforum parameter to moduleajouter/depot/adminforum.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "38646", "refsource": "OSVDB", "url": "http://osvdb.org/38646"}, {"name": "38648", "refsource": "OSVDB", "url": "http://osvdb.org/38648"}, {"name": "25951", "refsource": "BID", "url": "http://www.securityfocus.com/bid/25951"}, {"name": "38647", "refsource": "OSVDB", "url": "http://osvdb.org/38647"}, {"name": "ADV-2007-3429", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/3429"}, {"name": "elseif-multiple-xss(37007)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37007"}, {"name": "20071006 Else If cms Multiple Remote vulnerabilities", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/481683/100/0/threaded"}, {"name": "3204", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/3204"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T15:24:42.424Z"}, "title": "CVE Program Container", "references": [{"name": "38646", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/38646"}, {"name": "38648", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/38648"}, {"name": "25951", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/25951"}, {"name": "38647", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/38647"}, {"name": "ADV-2007-3429", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/3429"}, {"name": "elseif-multiple-xss(37007)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37007"}, {"name": "20071006 Else If cms Multiple Remote vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/481683/100/0/threaded"}, {"name": "3204", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/3204"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-5304", "datePublished": "2007-10-09T18:00:00", "dateReserved": "2007-10-09T00:00:00", "dateUpdated": "2024-08-07T15:24:42.424Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:yannick_tanguy:else_if_cms:0.6-beta:*:*:*:*:*:*:*", "matchCriteriaId": "BEE8B4EB-C1A5-4993-9661-F1510813E478", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) repertimage parameter to utilisateurs/vousetesbannis.php, the (2) elseifvotetxtresultatduvote parameter to utilisateurs/votesresultats.php, and the (3) elseifforumtxtmenugeneraleduforum parameter to moduleajouter/depot/adminforum.php."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en ELSEIF CMS Beta 0.6 permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s del par\u00e1metro (1)repertimage de utilisateurs/vousetesbannis.php, el par\u00e1metro (2) elseifvotetxtresultatduvote de utilisateurs/votesresultats.php, y el par\u00e1metro (3) elseifforumtxtmenugeneraleduforum de (moduleaujouter/depot/adminforum.php"}], "id": "CVE-2007-5304", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-10-09T18:17:00.000", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/38646"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/38647"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/38648"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/3204"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/481683/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/25951"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/3429"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37007"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/38646"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/38647"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/38648"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/3204"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/481683/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/25951"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/3429"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37007"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}