CVE-2007-4896

Toms Gaestebuch <= 1.01 - Cross-Site Scripting via lang or einst Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-4896. PoCs published by hd1979.

AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in Toms Gastebuch, detailing how unsanitized user input in specific parameters can lead to arbitrary script execution in a user's browser context.

Description

Multiple cross-site scripting (XSS) vulnerabilities in admin/header.php in Toms Gaestebuch 1.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) lang[adminseite], (2) lang[ueberschrift], or (3) einst[metachar] parameter, different vectors than CVE-2007-4711.

Exploits (1)

exploitdb WRITEUP VERIFIED
by hd1979 · textwebappsphp
https://www.exploit-db.com/exploits/30570

The provided text describes a cross-site scripting (XSS) vulnerability in Toms Gastebuch, detailing how unsanitized user input in specific parameters can lead to arbitrary script execution in a user's browser context.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Toms Gastebuch
No auth needed
Prerequisites: Access to the vulnerable web application
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/38660
Various Sources x_refsource_confirm
http://www.toms-seiten.at/guest/index.php?language=de
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/479992/100/100/threaded
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/478869/100/0/threaded
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/25598

Scores

EPSS 0.0053
EPSS Percentile 67.4%

Details

CWE
CWE-79
Status published
Products (2)
toms-seiten.at/toms_gastenbuch 1.00
toms-seiten.at/toms_gastenbuch 1.01
Published Sep 14, 2007
Tracked Since Feb 18, 2026