CVE-2004-0271
MaxWebPortal - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2004-0271. PoCs published by Manuel Lopez.
AI-analyzed exploit summary This exploit demonstrates an XSS vulnerability in MaxWebPortal versions prior to 1.32. The PoC uses a malicious JavaScript payload in a select option to steal cookies when the user interacts with the dropdown.
Description
Multiple cross-site scripting vulnerabilities (XSS) in MaxWebPortal allow remote attackers to execute arbitrary web script as other users via (1) the sub_name parameter of dl_showall.asp, (2) the SendTo parameter in Personal Messages, (3) the HTTP_REFERER for down.asp, or (4) the image name of an Avatar in the register form.
Exploits (2)
This exploit demonstrates an XSS vulnerability in MaxWebPortal versions prior to 1.32. The PoC uses a malicious JavaScript payload in a select option to steal cookies when the user interacts with the dropdown.
The provided text describes multiple vulnerabilities in MaxWebPortal versions prior to 1.32, including XSS, HTML injection, and SQL injection. It includes a snippet of code demonstrating an XSS vulnerability via the HTTP_REFERER server variable.