CVE-2007-3249

Letterman Subscriber < 1.2.3 - Cross-Site Scripting via Itemid Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-3249. PoCs published by Edi Strosar.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in the Joomla! Letterman Subscriber module by injecting a script tag into the URL parameter, which executes arbitrary JavaScript in the context of the affected site.

Description

Cross-site scripting (XSS) vulnerability in mod_lettermansubscribe.php in the Letterman Subscriber (mod_letterman) before 1.2.5 module for Joomla! allows remote attackers to inject arbitrary web script or HTML via the Itemid parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Edi Strosar · textwebappsphp

https://www.exploit-db.com/exploits/30190

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in the Joomla! Letterman Subscriber module by injecting a script tag into the URL parameter, which executes arbitrary JavaScript in the context of the affected site.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Joomla! Letterman Subscriber 1.2.4-RC1

No auth needed

Prerequisites: Access to a vulnerable Joomla! instance with the Letterman Subscriber module installed

MITRE ATT&CK