[原文]Multiple cross-site scripting (XSS) vulnerabilities in WMNews allow remote attackers to inject arbitrary web script or HTML via the (1) ArtCat parameter to wmview.php, (2) ctrrowcol parameter to footer.php, or (3) ArtID parameter to wmcomments.php.
WMNews contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'ArtCat' variable upon submission to the wmview.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.
-
时间线
2006-03-12
Unknow
2006-03-12
Unknow
-
解决方案
Currently, there are no known upgrades, patches, or workarounds available to correct this issue.
Try not to become a man of success but rather try to become a man of value.