CVE-2003-1285

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Sambar Server before 6.0 beta 6 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) isapi/testisa.dll, (2) testcgi.exe, (3) environ.pl, (4) the query parameter to samples/search.dll, (5) the price parameter to mortgage.pl, (6) the query string in dumpenv.pl, (7) the query string to dumpenv.pl, and (8) the E-Mail field of the guestbook script (book.pl).

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/9578Patch
http://securitytracker.com/id?1007819Patch
http://www.idefense.com/application/poi/display?id=103&type=vulnerabilities&flashstatus=trueVendor Advisory
http://www.osvdb.org/5782Exploit, Patch
http://www.osvdb.org/5783Exploit, Patch
http://www.osvdb.org/5784Exploit, Patch
http://www.osvdb.org/5785Exploit, Patch
http://www.osvdb.org/5805Exploit, Patch
http://www.sambar.com/security.htmVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/13305
https://exchange.xforce.ibmcloud.com/vulnerabilities/16056
http://secunia.com/advisories/9578Patch
http://securitytracker.com/id?1007819Patch
http://www.idefense.com/application/poi/display?id=103&type=vulnerabilities&flashstatus=trueVendor Advisory
http://www.osvdb.org/5782Exploit, Patch
http://www.osvdb.org/5783Exploit, Patch
http://www.osvdb.org/5784Exploit, Patch
http://www.osvdb.org/5785Exploit, Patch
http://www.osvdb.org/5805Exploit, Patch
http://www.sambar.com/security.htmVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/13305
https://exchange.xforce.ibmcloud.com/vulnerabilities/16056

Timeline

Published: Dec 31, 2003
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2003

CVE-2003-12867.5HTTP Proxy in Sambar Server before 6.0 beta 6, when security.ini lacks a 127.0.0.1 proxydeny entry, allows remote attackers to send proxy HT CVE-2003-12874.6Sambar Server before 6.0 beta 3 allows attackers with physical access to execute arbitrary code via a request with an MS-DOS device name suc CVE-2003-12885.0Multiple race conditions in Linux-VServer 1.22 with Linux kernel 2.4.23 and SMP allow local users to cause a denial of service (kernel oops)CVE-2003-12892.1The iBCS2 system call translator for statfs in NetBSD 1.5 through 1.5.3 and FreeBSD 4 up to 4.8-RELEASE-p2 and 5 up to 5.1-RELEASE-p1 allows CVE-2003-12905.0BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, with RMI and anonymous admin lookup enabled, allows remote attackers to obtain c CVE-2003-12917.2VMware ESX Server 1.5.2 before Patch 4 allows local users to execute arbitrary programs as root via certain modified VMware ESX Server envir CVE-2003-12925.0PHP remote file include vulnerability in Derek Ashauer ashNews 0.83 allows remote attackers to include and execute arbitrary remote files vi CVE-2003-12934.3Multiple cross-site scripting (XSS) vulnerabilities in NukedWeb GuestBookHost allow remote attackers to inject arbitrary web script or HTML CVE-2003-12942.1Xscreensaver before 4.15 creates temporary files insecurely in (1) driver/passwd-kerberos.c, (2) driver/xscreensaver-getimage-video, (3) dri CVE-2003-12952.1Unspecified vulnerability in xscreensaver 4.12, and possibly other versions, allows attackers to cause xscreensaver to crash via unspecified CVE-2003-12965.0Easy File Sharing (EFS) Web Server 1.2 allows remote authenticated users to cause a denial of service via (1) an "empty symbol" in the Title CVE-2003-12975.0Easy File Sharing (EFS) Web Server 1.2 stores the (1) option.ini (aka options.ini) file and (2) log directory under the web root with insuff