CVE-2005-1782
BookReview beta 1.0 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 9 public exploits for CVE-2005-1782. PoCs published by Lostmon.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in BookReview by injecting arbitrary script code via the 'node' parameter in the URL. The lack of input sanitization allows execution of JavaScript in the context of a victim's browser.
Description
Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node parameter to (1) add_review.htm, (2) suggest_review.htm, (3) suggest_category.htm, (4) add_booklist.htm, or (5) add_url.htm, the isbn parameter to (6) add_review.htm, (7) add_contents.htm, (8) add_classification.htm, the (9) chapters parameter to the add_contents page in index.php (aka add_contents.htm), (10) the user parameter to contact.htm, or (11) the submit[string] parameter to search.htm. NOTE: it is not clear whether BookReview is available to the public. If not, then it should not be included in CVE.
Exploits (9)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in BookReview by injecting arbitrary script code via the 'node' parameter in the URL. The lack of input sanitization allows execution of JavaScript in the context of a victim's browser.
The provided text describes a cross-site scripting (XSS) vulnerability in BookReview, where user-supplied input is not properly sanitized. The example demonstrates an XSS payload injected via the 'node' parameter in a URL.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in BookReview by injecting arbitrary script code via unsanitized user input in the search functionality. The PoC URL triggers an alert with the user's cookies, proving the vulnerability.
The provided text describes a cross-site scripting (XSS) vulnerability in BookReview, where user-supplied input is not properly sanitized. The example demonstrates how an attacker could inject arbitrary script code via the 'user' parameter in the URL.
The provided text describes a cross-site scripting (XSS) vulnerability in BookReview, where user-supplied input is not properly sanitized. The example demonstrates how an attacker could inject arbitrary script code via a URL parameter.
This exploit demonstrates multiple XSS vulnerabilities in BookReview by injecting arbitrary script code via unsanitized input parameters such as 'isbn' and 'node'. The PoC URLs trigger JavaScript alerts to steal cookie-based authentication credentials.
The provided text describes a cross-site scripting (XSS) vulnerability in BookReview, where user-supplied input is not properly sanitized. The example URL demonstrates an XSS payload that executes arbitrary JavaScript in the context of the victim's browser.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in BookReview by injecting arbitrary JavaScript code via the 'isbn' parameter. The PoC uses a simple alert to display the document cookie, proving the lack of input sanitization.
The provided text describes a cross-site scripting (XSS) vulnerability in BookReview, where user-supplied input is not properly sanitized. The example URL demonstrates an XSS payload that executes arbitrary JavaScript in the context of a victim's browser.