Description
Multiple cross-site scripting (XSS) vulnerabilities in PHPChain 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the catid parameter to (1) settings.php or (2) cat.php. NOTE: certain parameter values also trigger path disclosure.
References
- http://pridels0.blogspot.com/2007/05/phpchain-vuln.html
- ADV-2007-1647 vdb-entry
- phpchain-settings-cat-xss(34018) vdb-entry
- 23761 vdb-entry
- 35536 vdb-entry
- 35537 vdb-entry
- 25128 third-party-advisory