CVE-2007-2300 - Vulnerability Details - OpenCVE

Multiple cross-site scripting (XSS) vulnerabilities in Endy Kristanto Surat kabar / News Management Online (aka phpwebnews) 0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the m_txt parameter to (1) iklan.php, (2) index.php, or (3) bukutamu.php.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.02395.

Key SSVC decision points have not yet been added.

Vendors	Products
Surat Kabar	Phpwebnews

Configuration 1 [-]

OR	cpe:2.3:a:surat_kabar:phpwebnews:0.1:::::::*
	cpe:2.3:a:surat_kabar:phpwebnews:0.2:::::::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2007-2295	Multiple cross-site scripting (XSS) vulnerabilities in Endy Kristanto Surat kabar / News Management Online (aka phpwebnews) 0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the m_txt parameter to (1) iklan.php, (2) index.php, or (3) bukutamu.php.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://securityreason.com/securityalert/2643
http://www.osvdb.org/35365
http://www.osvdb.org/35366
http://www.osvdb.org/35367
http://www.securityfocus.com/archive/1/465545/100/0/threaded
http://www.securityfocus.com/bid/23448
https://exchange.xforce.ibmcloud.com/vulnerabilities/33641

History

Fri, 11 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.02246}`	epss `{'score': 0.02395}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-04-26T21:00:00

Updated: 2024-08-07T13:33:28.546Z

Reserved: 2007-04-26T00:00:00

Link: CVE-2007-2300

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-04-26T21:19:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-2300

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-04-12T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Endy Kristanto Surat kabar / News Management Online (aka phpwebnews) 0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the m_txt parameter to (1) iklan.php, (2) index.php, or (3) bukutamu.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "35365", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/35365"}, {"name": "23448", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/23448"}, {"name": "phpwebnews-mtxt-xss(33641)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33641"}, {"name": "2643", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/2643"}, {"name": "35366", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/35366"}, {"name": "20070412 phpwebnews v.1 Multiple Cross Site Scripting Vulnerabilites", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/465545/100/0/threaded"}, {"name": "35367", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/35367"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-2300", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Endy Kristanto Surat kabar / News Management Online (aka phpwebnews) 0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the m_txt parameter to (1) iklan.php, (2) index.php, or (3) bukutamu.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "35365", "refsource": "OSVDB", "url": "http://www.osvdb.org/35365"}, {"name": "23448", "refsource": "BID", "url": "http://www.securityfocus.com/bid/23448"}, {"name": "phpwebnews-mtxt-xss(33641)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33641"}, {"name": "2643", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/2643"}, {"name": "35366", "refsource": "OSVDB", "url": "http://www.osvdb.org/35366"}, {"name": "20070412 phpwebnews v.1 Multiple Cross Site Scripting Vulnerabilites", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/465545/100/0/threaded"}, {"name": "35367", "refsource": "OSVDB", "url": "http://www.osvdb.org/35367"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T13:33:28.546Z"}, "title": "CVE Program Container", "references": [{"name": "35365", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/35365"}, {"name": "23448", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/23448"}, {"name": "phpwebnews-mtxt-xss(33641)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33641"}, {"name": "2643", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/2643"}, {"name": "35366", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/35366"}, {"name": "20070412 phpwebnews v.1 Multiple Cross Site Scripting Vulnerabilites", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/465545/100/0/threaded"}, {"name": "35367", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/35367"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-2300", "datePublished": "2007-04-26T21:00:00", "dateReserved": "2007-04-26T00:00:00", "dateUpdated": "2024-08-07T13:33:28.546Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:surat_kabar:phpwebnews:0.1:*:*:*:*:*:*:*", "matchCriteriaId": "64EC1995-9002-4852-8F82-9E99FC28A53D", "vulnerable": true}, {"criteria": "cpe:2.3:a:surat_kabar:phpwebnews:0.2:*:*:*:*:*:*:*", "matchCriteriaId": "CCB69ADE-97BF-4A11-8CAF-05C7202633B3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Endy Kristanto Surat kabar / News Management Online (aka phpwebnews) 0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the m_txt parameter to (1) iklan.php, (2) index.php, or (3) bukutamu.php."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Endy Kristanto Surat kabar / News Management Online (tambi\u00e9n conocido como phpwebnews) 0.2 y versiones anteriores permiten a atacantes remotos inyectar scripts web o HTML de su elecci\u00f3n mediante el par\u00e1metro m_txt en (1) iklan.php, (2) index.php, \u00f3 (3) bukutamu.php."}], "id": "CVE-2007-2300", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-04-26T21:19:00.000", "references": [{"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/2643"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/35365"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/35366"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/35367"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/465545/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/23448"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33641"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/2643"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/35365"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/35366"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/35367"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/465545/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/23448"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33641"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}