CVE-2004-1640

XOOPS 0.94 and 1.0 - Cross-Site Scripting via Search Term or Letter Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2004-1640. PoCs published by CyruxNET.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in the XOOPS Dictionary Module by Nagle. The PoC includes a malicious script that can be injected via the 'letter.php' script to execute arbitrary JavaScript in the context of a user's browser.

Description

Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers to execute arbitrary web script and HTML via the (1) terme parameter to search.php or (2) letter parameter to letter.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by CyruxNET · textwebappsphp

https://www.exploit-db.com/exploits/24415

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in the XOOPS Dictionary Module by Nagle. The PoC includes a malicious script that can be injected via the 'letter.php' script to execute arbitrary JavaScript in the context of a user's browser.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: XOOPS Dictionary Module by Nagle

No auth needed

Prerequisites: User interaction required to follow a malicious link

MITRE ATT&CK