medium4.3Public exploit code

CVE-2005-4196

Multiple cross-site scripting (XSS) vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HT…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Scout Portal Toolkit 1.3.1 - 'SPT-AdvancedSearch.php' Cross-Site Scripting2005-12-12 · webapps · php · Verified
Scout Portal Toolkit 1.3.1 - 'SPT-BrowseResources.php' Cross-Site Scripting2005-12-12 · webapps · php · Verified
Scout Portal Toolkit 1.3.1 - 'SPT-QuickSearch.php' Cross-Site Scripting2005-12-12 · webapps · php · Verified

Impact

Multiple cross-site scripting (XSS) vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the ss parameter in SPT--QuickSearch.php; (2) ParentId parameter in SPT--BrowseResources.php; (3) the ResourceId parameter in SPT--FullRecord.php; (4) ResourceOffset parameter in SPT--Home.php, (5) F_SearchString parameter in SPT--QuickSearch.php; (6) F_UserName and (7) F_Password parameters in SPT--UserLogin.php; (8) F_SearchCat1, (9) F_TextField1, (10) F_SearchCat2, (11) F_TextField2, (12) F_SearchCat3, (13) F_TextField3, (14) F_SearchCat4, (15) F_TextField4, (16) ResourceType, (17) Language, (18) Audience, (19) Format parameters in SPT--AdvancedSearch.php.

Affected products

Vendor	Product	Affected versions
Internet Scout	Scout Portal Toolkit	through 1.3.1 Version 1.3.0_beta

Public exploit code

Impact

Affected products

References