CVE-2007-2337
Exponent CMS <= 0.96.6 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2007-2337. PoCs published by Hamid Ebadi.
AI-analyzed exploit summary This exploit demonstrates a reflected XSS vulnerability in Exponent CMS by injecting a malicious script via the 'rss_url' parameter in magpie_slashbox.php. The script executes in the context of the user's browser, potentially stealing cookie-based authentication credentials.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS 0.96.6 Alpha and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) magpie_debug.php and (b) magpie_simple.php in external/magpierss/scripts/, the (2) rss_url parameter to (c) magpie_slashbox.php in external/magpierss/scripts/, and the (3) body parameter to the (d) weblogmodule (aka Weblog Comments) module.
Exploits (2)
This exploit demonstrates a reflected XSS vulnerability in Exponent CMS by injecting a malicious script via the 'rss_url' parameter in magpie_slashbox.php. The script executes in the context of the user's browser, potentially stealing cookie-based authentication credentials.
The provided text describes a reflected XSS vulnerability in Exponent CMS via the 'url' parameter in magpie_debug.php. It lacks executable exploit code but includes a proof-of-concept URL demonstrating the issue.