Exploitation Summary
EIP tracks 5 public exploits for CVE-2004-0660. PoCs published by DarkBicho, Debasis Mohanty.
AI-analyzed exploit summary This exploit demonstrates an HTML injection vulnerability in CutePHP, where user-supplied input in comment posts is not sufficiently sanitized. An attacker can inject malicious HTML code via URI arguments, which may be rendered in the user's browser.
Description
Cross-site scripting (XSS) vulnerability in (1) show_archives.php, (2) show_news.php, and possibly other php files in CuteNews 1.3.1 allows remote attackers to inject arbitrary script or HTML via the id parameter.
Exploits (5)
This exploit demonstrates an HTML injection vulnerability in CutePHP, where user-supplied input in comment posts is not sufficiently sanitized. An attacker can inject malicious HTML code via URI arguments, which may be rendered in the user's browser.
The provided text describes a cross-site scripting (XSS) vulnerability in CuteNews 1.3.1 due to improper sanitization of user-supplied URI input. It includes a proof-of-concept URI demonstrating the vulnerability but lacks executable exploit code.
The provided text describes a cross-site scripting (XSS) vulnerability in CuteNews, where the 'id' parameter in multiple scripts fails to sanitize user-supplied input, allowing execution of arbitrary HTML and script code.
The provided text describes a cross-site scripting (XSS) vulnerability in CuteNews, where the 'id' parameter in multiple scripts fails to sanitize user-supplied input, allowing arbitrary script execution in the context of a victim's browser.
The provided text describes a cross-site scripting (XSS) vulnerability in CuteNews, where the 'id' parameter in multiple scripts fails to sanitize user-supplied input, allowing execution of arbitrary HTML and script code.