vulnwire
4.3med

CVE-2005-17829 exploits

Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML vi…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
5.1%
percentile 92%
Public exploits
9
Exploit-DB

Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node parameter to (1) add_review.htm, (2) suggest_review.htm, (3) suggest_category.htm, (4) add_booklist.htm, or (5) add_url.htm, the isbn parameter to (6) add_review.htm, (7) add_contents.htm, (8) add_classification.htm, the (9) chapters parameter to the add_contents page in index.php (aka add_contents.htm), (10) the user parameter to contact.htm, or (11) the submit[string] parameter to search.htm. NOTE: it is not clear whether BookReview is available to the public. If not, then it should not be included in CVE.

Exploit prediction (EPSS)

5.13% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.

Exploits and detections

  • EDB-25735 BookReview 1.0 - 'suggest_review.htm?node' Cross-Site Scripting · webapps · 2005-05-26
  • EDB-25734 BookReview 1.0 - 'add_classification.htm?isbn' Cross-Site Scripting · webapps · 2005-05-26
  • EDB-25733 BookReview 1.0 - 'search.htm?submit string' Cross-Site Scripting · webapps · 2005-05-26
  • EDB-25732 BookReview 1.0 - 'add_url.htm?node' Cross-Site Scripting · webapps · 2005-05-26
  • EDB-25731 BookReview 1.0 - 'add_booklist.htm?node' Cross-Site Scripting · webapps · 2005-05-26
  • EDB-25730 BookReview 1.0 - 'contact.htm?user' Cross-Site Scripting · webapps · 2005-05-26
  • EDB-25729 BookReview 1.0 - 'suggest_category.htm?node' Cross-Site Scripting · webapps · 2005-05-26
  • EDB-25728 BookReview 1.0 - 'add_contents.htm' Multiple Cross-Site Scripting Vulnerabilities · webapps · 2005-05-26
  • EDB-25727 BookReview 1.0 - 'add_review.htm' Multiple Cross-Site Scripting Vulnerabilities · webapps · 2005-05-26

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

References

  • securityfocus.com /bid/13783 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id?1014058 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • osvdb.org /16873 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /16876 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /16874 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /16878 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /16879 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /16871 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /16872 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /16875 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /16877 · vdb-entry, x_refsource_OSVDB, x_transferred
  • lostmon.blogspot.com /2005/05/bookreview-10-multiple-variable-xss.html · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.