CVE-2007-2801
eTicket 1.5.5 and 1.5.5.1 - Cross-Site Scripting via err and warn Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-2801. PoCs published by Jesper Jurcenoks.
AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in eTicket versions 1.5.5 and 1.5.5.1, where user-supplied input is not properly sanitized in the 'err' and 'warn' parameters of the open.php file. It includes example URLs demonstrating the vulnerability but does not contain executable exploit code.
Description
Multiple cross-site scripting (XSS) vulnerabilities in open.php in eTicket 1.5.5 and 1.5.5.1, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) err and (2) warn parameters. NOTE: the vendor disputes the significance of the issue, stating that "eTicket is not designed to work with register_globals On."
Exploits (1)
The provided text describes a cross-site scripting (XSS) vulnerability in eTicket versions 1.5.5 and 1.5.5.1, where user-supplied input is not properly sanitized in the 'err' and 'warn' parameters of the open.php file. It includes example URLs demonstrating the vulnerability but does not contain executable exploit code.