CVE-2004-2511
DCP-Portal <= 5.3.2 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2004-2511. PoCs published by Alexander Antipov.
AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in DCP-Portal, where insufficient filtering of URI parameters allows remote attackers to execute arbitrary script code in the context of a legitimate user's browser.
Description
Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the year, (2) month, and (3) day parameters in calendar.php; (4) the cid and (5) url parameters in index.php; (6) the cid parameter in annoucement.php; (7) the cid parameter in news.php; (8) the cid parameter in contents.php; (9) the q parameter in search.php; and (10) the country parameter in register.php.
Exploits (3)
The provided text describes a cross-site scripting (XSS) vulnerability in DCP-Portal, where insufficient filtering of URI parameters allows remote attackers to execute arbitrary script code in the context of a legitimate user's browser.
The provided text describes a cross-site scripting (XSS) vulnerability in DCP-Portal, where URI parameters in calendar.php are not sufficiently filtered. An attacker can craft malicious links to execute arbitrary script code in the context of a victim's browser.
The provided text describes a cross-site scripting (XSS) vulnerability in DCP-Portal, where URI parameters are insufficiently filtered, allowing script execution in the context of the vulnerable website. It includes an example exploit URL but no actual exploit code.