CVE-2007-0364
nicecoder INDEXU <= 5.3 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 12 public exploits for CVE-2007-0364. PoCs published by SwEET-DeViL.
AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in Indexu 5.3.0 and prior versions. It explains the vulnerability and provides a sample URL for exploitation but does not include actual exploit code.
Description
Multiple cross-site scripting (XSS) vulnerabilities in nicecoder.com INDEXU 5.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) error_msg parameter to (a) suggest_category.php; the (2) u parameter to (b) user_detail.php; the (3) friend_name, (4) friend_email, (5) error_msg, (6) my_name, (7) my_email, and (8) id parameters to (c) tell_friend.php; the (9) error_msg, (10) email, (11) name, and (12) subject parameters to (d) sendmail.php; the (13) email, (14) error_msg, and (15) username parameters to (e) send_pwd.php; the (16) keyword parameter to (f) search.php; the (17) error_msg, (18) username, (19) password, (20) password2, and (21) email parameters to (g) register.php; the (22) url, (23) contact_name, and (24) email parameters to (h) power_search.php; the (25) path and (26) total parameters to (i) new.php; the (27) query parameter to (j) modify.php; the (28) error_msg parameter to (k) login.php; the (29) error_msg and (30) email parameters to (l) mailing_list.php; the (31) gateway parameter to (m) upgrade.php; and another unspecified vector.
Exploits (12)
The provided text describes a cross-site scripting (XSS) vulnerability in Indexu 5.3.0 and prior versions. It explains the vulnerability and provides a sample URL for exploitation but does not include actual exploit code.
The provided text describes a cross-site scripting (XSS) vulnerability in Indexu 5.3.0 and prior versions. It includes a sample URL demonstrating how an attacker could exploit the vulnerability by injecting arbitrary script code via the 'gateway' parameter.
The provided text describes multiple XSS vulnerabilities in Indexu 5.3.0 and prior versions due to improper input sanitization in the 'tell_friend.php' script. It lists vulnerable parameters but does not include executable exploit code.
The provided text describes a cross-site scripting (XSS) vulnerability in Indexu 5.3.0 and prior versions. It explains the issue and provides a sample URL to demonstrate the vulnerability but does not include executable exploit code.
The provided text describes multiple XSS vulnerabilities in Indexu 5.3.0 and prior versions due to improper input sanitization in the 'send_pwd.php' script. It includes example URLs demonstrating the vulnerability but does not contain executable exploit code.
The provided text describes multiple XSS vulnerabilities in Indexu 5.3.0 and prior versions due to improper input sanitization in the 'sendmail.php' script. It lists vulnerable parameters but does not include executable exploit code.
The provided text describes a cross-site scripting (XSS) vulnerability in Indexu 5.3.0 and prior versions. It explains the issue and provides a sample exploit URL but does not include functional exploit code.
The provided text describes multiple cross-site scripting (XSS) vulnerabilities in Indexu 5.3.0 and prior versions. It outlines how an attacker can inject arbitrary script code via unsanitized input parameters in the register.php file.
The provided text describes multiple XSS vulnerabilities in Indexu 5.3.0 and prior versions due to improper input sanitization in the 'power_search.php' script. It includes example URLs demonstrating the vulnerability but does not contain executable exploit code.
The provided text describes a cross-site scripting (XSS) vulnerability in Indexu 5.3.0 and prior versions. It outlines the vulnerability's impact and provides example URLs demonstrating the XSS vectors.
The provided text describes a cross-site scripting (XSS) vulnerability in Indexu 5.3.0 and prior versions. It includes example URLs demonstrating how arbitrary script code can be executed in the context of the affected site.
This is a writeup describing a cross-site scripting (XSS) vulnerability in Indexu 5.3.0 and prior versions. The vulnerability arises from improper sanitization of user-supplied input in the 'error_msg' parameter of login.php.