FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-2016

This CVE name corresponds to:

Entered	Topic
2006-05-14	phpldapadmin -- Cross-Site Scripting and Script Insertion vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-2016 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-2016
Phase	Assigned(20060425)

Description

Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dn parameter in (a) compare_form.php, (b) copy_form.php, (c) rename_form.php, (d) template_engine.php, and (e) delete_form.php; (2) scope parameter in (f) search.php; and (3) Container DN, (4) Machine Name, and (5) UID Number fields in (g) template_engine.php.

References

Source	Reference
MISC	http://pridels0.blogspot.com/2006/04/phpldapadmin-multiple-vuln.html
DEBIAN	DSA-1057
BID	17643
VUPEN	ADV-2006-1450
OSVDB	24788
OSVDB	24789
OSVDB	24790
OSVDB	24792
OSVDB	24793
OSVDB	24794
SECUNIA	19747
SECUNIA	20124
XF	phpldapadmin-templateengine-xss(25959)
XF	phpldapadmin-scope-dn-xss(25958)