CVE-2010-0997
e107 Content Management Plugin Script Insertion
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Cross-site scripting (XSS) vulnerability in 107_plugins/content/content_manager.php in the Content Management plugin in e107 before 0.7.20, when the personal content manager is enabled, allows user-assisted remote authenticated users to inject arbitrary web script or HTML via the content_heading parameter.
Vulnerabilidad de secuencias de comandos en sitios cruzados en 107_plugins/content/content_manager.php en el complemento -plugin- Content Management de e107 anterior a v0.7.20, cuando el gestor de contenido personal está habilitado, permite a usuarios autenticados en remoto asistidos por usuarios locales inyectar secuencias de comandos Web o HTML mediante el parámetro content_heading.
Secunia Research has discovered a vulnerability in e107, which can be exploited by malicious users to conduct script insertion attacks. Input passed via the "content_heading" parameter to 107_plugins/content/content_manager.php while creating new content is not properly sanitized before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. Successful exploitation requires authentication and that the Content Management plugin is enabled. e107 version 0.7.19 is affected.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2010-03-18 CVE Reserved
- 2010-04-19 CVE Published
- 2024-08-07 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://e107.org/svn_changelog.php?version=0.7.20 | X_refsource_misc | |
| http://www.securityfocus.com/archive/1/510809/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/39539 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/57933 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://e107.org/comment.php?comment.news.864 | 2018-10-10 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/39013 | 2018-10-10 | |
| http://secunia.com/secunia_research/2010-43 | 2018-10-10 | |
| http://www.vupen.com/english/advisories/2010/0919 | 2018-10-10 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | <= 0.7.19 Search vendor "E107" for product "E107" and version " <= 0.7.19" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.0 Search vendor "E107" for product "E107" and version "0.7.0" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.1 Search vendor "E107" for product "E107" and version "0.7.1" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.2 Search vendor "E107" for product "E107" and version "0.7.2" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.3 Search vendor "E107" for product "E107" and version "0.7.3" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.4 Search vendor "E107" for product "E107" and version "0.7.4" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.5 Search vendor "E107" for product "E107" and version "0.7.5" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.6 Search vendor "E107" for product "E107" and version "0.7.6" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.7 Search vendor "E107" for product "E107" and version "0.7.7" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.8 Search vendor "E107" for product "E107" and version "0.7.8" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.9 Search vendor "E107" for product "E107" and version "0.7.9" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.10 Search vendor "E107" for product "E107" and version "0.7.10" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.11 Search vendor "E107" for product "E107" and version "0.7.11" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.12 Search vendor "E107" for product "E107" and version "0.7.12" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.13 Search vendor "E107" for product "E107" and version "0.7.13" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.14 Search vendor "E107" for product "E107" and version "0.7.14" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.15 Search vendor "E107" for product "E107" and version "0.7.15" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.16 Search vendor "E107" for product "E107" and version "0.7.16" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.17 Search vendor "E107" for product "E107" and version "0.7.17" | - |
Affected
| ||||||
| E107 Search vendor "E107" | E107 Search vendor "E107" for product "E107" | 0.7.18 Search vendor "E107" for product "E107" and version "0.7.18" | - |
Affected
| ||||||