[VIM] Vendor dispute of CVE-2006-2184
Steven M. Christey
coley at mitre.org
Fri May 12 01:28:49 EDT 2006
FYI... while d4igoro's web page notes that the vendor disputes this
issue, and this is reflected in the CVE, the vendor has sent email
directly to CVE/NVD saying:
there is no such hole in our product and we fully claim that our
product PHPKB Knowledge Base Script is free from any such
“script attack” hole in it. You can test the script at
Having been given their go-ahead to test their demo site, you can
predict what I was able to find out within about 2 minutes.
granted, <abc> and <script> did not work, but...
hint: onmouseover anybody?
oh ok, I'll save you the 30 seconds:
Make sure to wave your mouse over the search form.
I'll be sure to pass on their response to this latest finding.
P.S. Brian, weren't you gonna write up a "so somebody has found an XSS
and you dispute it" FAQ? ;-) Or did something have to happen first?
Acknowledged: unknown discloser-claimed
** DISPUTED **
Cross-site scripting (XSS) vulnerability in search.php in PHPKB
Knowledge Base allows remote attackers to inject arbitrary web script
or HTML via the searchkeyword parameter. NOTE: the original
researcher claims that the vendor disputed the vulnerability, saying
that only the vendor's own demo page was affected. On 20060511, the
vendor notified CVE that the dispute was still active. At the
invitation of the vendor to test the demo site, CVE was able to verify
ACKNOWLEDGEMENT: at the top of the researchers page for this
vulnerability he says "pdate: the vendor have informed me that there
is no hole. i only had a look on the online demo. if you want you can
send me a fullversion. :)"
ACCURACY: on 20060510, the vendor emailed a dispute to CVE regarding
this issue, suggesting that CVE could test their demo web site. CVE
the vendor early in 20060511. As of 20060511, the issue appears to be
More information about the VIM