CVE-2004-0322
XMB 1.8 Final SP2 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2004-0322. PoCs published by Janek Vind.
AI-analyzed exploit summary This exploit demonstrates an XSS vulnerability in XMB Forum by injecting malicious JavaScript via the 'align' attribute in BBCode. The PoC triggers an alert with the user's cookies when the mouse hovers over the injected text.
Description
Multiple cross-site scripting (XSS) vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to execute arbitrary script as other users via the (1) member parameter in member.php, (2) uid parameter in u2uadmin.php, (3) user parameter in editprofile.php, (4) an onmouseover event in an align tag when bbcode is allowed, or (5) img tag where bbcode is allowed.
Exploits (3)
This exploit demonstrates an XSS vulnerability in XMB Forum by injecting malicious JavaScript via the 'align' attribute in BBCode. The PoC triggers an alert with the user's cookies when the mouse hovers over the injected text.
This exploit demonstrates an XSS vulnerability in XMB Forum by injecting a script tag into the 'uid' parameter of u2uadmin.php, which executes arbitrary JavaScript in the context of the user's browser.
This exploit demonstrates an XSS vulnerability in XMB Forum by injecting a script tag into the 'user' parameter of the editprofile.php page. The lack of input sanitization allows arbitrary JavaScript execution in the context of the victim's browser.