medium4.3Public exploit code
CVE-2006-4838
Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) root_url and…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- DCP-Portal 6.0 - '/admin/inc/header.inc.php' Multiple Cross-Site Scripting Vulnerabilities2006-09-14 · webapps · php · Verified
- DCP-Portal 6.0 - '/admin/inc/footer.inc.php' Multiple Cross-Site Scripting Vulnerabilities2006-09-14 · webapps · php · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) root_url and (2) dcp_version parameters in (a) admin/inc/footer.inc.php, and the root_url, (3) page_top_name, (4) page_name, and (5) page_options parameters in (b) admin/inc/header.inc.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Codeworx Technologies | Dcp-Portal | Version se_6.0 |
References
- NVD record
- CVE.org record
- http://securityreason.com/securityalert/1585
- http://www.securityfocus.com/archive/1/445996/100/0/threaded
- http://www.securityfocus.com/bid/20024
- http://securityreason.com/securityalert/1585
- http://www.securityfocus.com/archive/1/445996/100/0/threaded
- http://www.securityfocus.com/bid/20024