CVE-2005-3473
Simple PHP Blog <= 0.4.5 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2005-3473. PoCs published by [email protected].
AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Simple PHP Blog by injecting malicious JavaScript into the 'blog_text' and 'file_name' parameters. The PoC automatically submits forms to trigger the vulnerability, executing arbitrary script code in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog 0.4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) entry, (2) blog_subject, and (3) blog_text parameters (involving the temp_subject variable) in (a) preview_cgi.php and (b) preview_static_cgi.php, or (4) scheme_name parameter and (5) bg_color parameters (involving the preset_name and result variables) in (c) colors.php.
Exploits (3)
This exploit demonstrates a stored XSS vulnerability in Simple PHP Blog by injecting malicious JavaScript into the 'blog_text' and 'file_name' parameters. The PoC automatically submits forms to trigger the vulnerability, executing arbitrary script code in the context of the affected site.
This exploit demonstrates multiple XSS vulnerabilities in Simple PHP Blog by injecting malicious JavaScript via the 'blog_subject' and 'blog_text' parameters. The PoC uses auto-submitting forms to trigger the payloads, which execute arbitrary script code in the context of the affected site.
This exploit demonstrates a stored XSS vulnerability in Simple PHP Blog by injecting malicious JavaScript into the 'scheme_name' and 'bg_color' parameters. The PoC submits forms with crafted input to trigger the execution of arbitrary script code in the context of the affected site.