medium5.8Public exploit code

CVE-2006-3009

Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 1.0.3 pl1 allow remote attackers to inject arbitrary HTML or web script v…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Open Business Management 1.0.3 pl1 - 'company_index.php' Multiple Cross-Site Scripting Vulnerabilities2006-06-07 · webapps · php · Verified
Open Business Management 1.0.3 pl1 - 'list_index.php' Multiple Cross-Site Scripting Vulnerabilities2006-06-07 · webapps · php · Verified
Open Business Management 1.0.3 pl1 - 'user_index.php?tf_lastname' Cross-Site Scripting2006-06-07 · webapps · php · Verified
Open Business Management 1.0.3 pl1 - 'group_index.php' Multiple Cross-Site Scripting Vulnerabilities2006-06-07 · webapps · php · Verified
Open Business Management 1.0.3 pl1 - 'publication_index.php?tf_lang' Cross-Site Scripting2006-06-07 · webapps · php · Verified

Impact

Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 1.0.3 pl1 allow remote attackers to inject arbitrary HTML or web script via the (1) tf_lang, (2) tf_name, (3) tf_user, (4) tf_lastname, (5) tf_contact, (6) tf_datebefore, and (7) tf_dateafter parameters to files such as (a) publication/publication_index.php, (b) group/group_index.php, (c) user/user_index.php, (d) list/list_index.php, and (e) company/company_index.php.

Affected products

Vendor	Product	Affected versions
Aliacom	Open Business Management	Version 1.0.3_pl1

Public exploit code

Impact

Affected products

References