CVE-2005-1782

Public Exploit

Description

Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node parameter to (1) add_review.htm, (2) suggest_review.htm, (3) suggest_category.htm, (4) add_booklist.htm, or (5) add_url.htm, the isbn parameter to (6) add_review.htm, (7) add_contents.htm, (8) add_classification.htm, the (9) chapters parameter to the add_contents page in index.php (aka add_contents.htm), (10) the user parameter to contact.htm, or (11) the submit[string] parameter to search.htm. NOTE: it is not clear whether BookReview is available to the public. If not, then it should not be included in CVE.

4.3

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 1.77% Top 20%

Vendor Advisory blogspot.com Vendor Advisory securitytracker.com Vendor Advisory osvdb.org Vendor Advisory osvdb.org Vendor Advisory osvdb.org Vendor Advisory osvdb.org Vendor Advisory osvdb.org Vendor Advisory osvdb.org Vendor Advisory osvdb.org Vendor Advisory osvdb.org Vendor Advisory osvdb.org Vendor Advisory securityfocus.com

Affected: n/a n/a

References

Link	Tags
http://www.securityfocus.com/bid/13783	vdb entry vendor advisory
http://securitytracker.com/id?1014058	vdb entry vendor advisory
http://www.osvdb.org/16873	vdb entry vendor advisory
http://www.osvdb.org/16876	vdb entry vendor advisory
http://www.osvdb.org/16874	vdb entry vendor advisory
http://www.osvdb.org/16878	vdb entry vendor advisory
http://www.osvdb.org/16879	vdb entry vendor advisory
http://www.osvdb.org/16871	vdb entry vendor advisory
http://www.osvdb.org/16872	vdb entry vendor advisory
http://www.osvdb.org/16875	vdb entry vendor advisory
http://www.osvdb.org/16877	vdb entry vendor advisory
http://lostmon.blogspot.com/2005/05/bookreview-10-multiple-variable-xss.html	exploit vendor advisory

Frequently Asked Questions

What is the severity of CVE-2005-1782?: CVE-2005-1782 has been scored as a medium severity vulnerability.
How to fix CVE-2005-1782?: To fix CVE-2005-1782, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2005-1782 being actively exploited in the wild?: It is possible that CVE-2005-1782 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~2% probability that this vulnerability will be exploited by malicious actors in the next 30 days.