CVE-2007-5112

Google Urchin < 5.7.03 - Cross-Site Scripting via Login Page Query String

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-5112. PoCs published by pagvac.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Urchin by injecting a script tag into the 'session.cgi' URL parameter. The lack of input sanitization allows arbitrary JavaScript execution in the context of the affected site.

Description

Cross-site scripting (XSS) vulnerability in session.cgi (aka the login page) in Google Urchin 5 5.7.03 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, a different vulnerability than CVE-2007-4713. NOTE: this can be leveraged to capture login credentials in some browsers that support remembered (auto-completed) passwords.

Exploits (1)

exploitdb WORKING POC VERIFIED

by pagvac · textwebappscgi

https://www.exploit-db.com/exploits/30606

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Urchin by injecting a script tag into the 'session.cgi' URL parameter. The lack of input sanitization allows arbitrary JavaScript execution in the context of the affected site.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Urchin (version not specified)

No auth needed

Prerequisites: Access to the target's 'session.cgi' endpoint

MITRE ATT&CK