CVE-2007-1678

Fizzle 0.5 - Cross-Site Scripting via RSS Feed Processing

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-1678. PoCs published by CrYpTiC MauleR.

AI-analyzed exploit summary This exploit demonstrates an HTML injection vulnerability in Fizzle 0.5, allowing arbitrary JavaScript execution. The PoC includes functions to read local files and steal cookies via Mozilla's XPCOM interfaces, confirming the vulnerability's impact.

Description

Cross-site scripting (XSS) vulnerability in the Fizzle 0.5 extension for Firefox allows remote attackers to inject arbitrary web script or HTML via RSS feeds, which are executed by the chrome: URI handler.

Exploits (1)

exploitdb WORKING POC VERIFIED

by CrYpTiC MauleR · textwebappsphp

https://www.exploit-db.com/exploits/29783

View Code ZIP pw:eip

This exploit demonstrates an HTML injection vulnerability in Fizzle 0.5, allowing arbitrary JavaScript execution. The PoC includes functions to read local files and steal cookies via Mozilla's XPCOM interfaces, confirming the vulnerability's impact.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Fizzle 0.5

No auth needed

Prerequisites: Victim must visit a crafted webpage or input maliciously crafted data into the application

MITRE ATT&CK