CVE-2007-6367
SineCMS < 2.3.4 - Cross-Site Scripting via Guestbook Username or Comment Field
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-6367. PoCs published by KiNgOfThEwOrLd.
AI-analyzed exploit summary The exploit demonstrates SQL injection in SineCMS <= 2.3.4 via the 'id' parameter in the Calendar module, allowing an attacker to extract sensitive data (e.g., passwords) from the database. Additional SQL injection vectors in the admin panel and a persistent XSS vulnerability in the guestbook are also described.
Description
Multiple cross-site scripting (XSS) vulnerabilities in the guestbook in SineCMS 2.3.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username (user) or (2) comment (commento) field, different vectors than CVE-2007-2357.
Exploits (1)
The exploit demonstrates SQL injection in SineCMS <= 2.3.4 via the 'id' parameter in the Calendar module, allowing an attacker to extract sensitive data (e.g., passwords) from the database. Additional SQL injection vectors in the admin panel and a persistent XSS vulnerability in the guestbook are also described.