CVE-2007-3001

EPSS 1.9%

Multiple cross-site scripting (XSS) vulnerabilities in PHP JackKnife (PHPJK) allow remote attackers to inject arbitrary web script or HTML via (1) the sUName parameter to UserArea/Authenticate.php, (2) the sAccountUnq parameter to UserArea/NewAccounts/index.php, or the (3) iCategoryUnq, (4) iDBLoc, (5) iTtlNumItems, (6) iNumPerPage, or (7) sSort parameter to G_Display.php, different vectors than CVE-2005-4239.

Affected products

n/a · n/a

public PoCs found — 3

exploitdbwww.exploit-db.com/exploits/30116unverified exploitdbwww.exploit-db.com/exploits/30114unverified exploitdbwww.exploit-db.com/exploits/30115unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/38877 http://osvdb.org/38878 http://osvdb.org/38879 http://securityreason.com/securityalert/2768 https://exchange.xforce.ibmcloud.com/vulnerabilities/34643 http://www.securityfocus.com/archive/1/470111/100/0/threaded http://www.securityfocus.com/bid/24253