CVE-2007-6608
OpenBiblio <= 0.5.2-pre4 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2007-6608. PoCs published by Juan Galiana Lara.
AI-analyzed exploit summary This exploit demonstrates an XSS vulnerability in OpenBiblio's theme_preview.php by injecting a malicious script into the 'themeName' parameter. The script executes arbitrary JavaScript, potentially stealing cookie-based authentication credentials.
Description
Multiple cross-site scripting (XSS) vulnerabilities in OpenBiblio 0.5.2-pre4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) LAST and (2) FIRST parameters to admin/staff_del_confirm.php, (3) the name parameter to admin/theme_del_confirm.php, or (4) the themeName parameter to admin/theme_preview.php.
Exploits (3)
This exploit demonstrates an XSS vulnerability in OpenBiblio's theme_preview.php by injecting a malicious script into the 'themeName' parameter. The script executes arbitrary JavaScript, potentially stealing cookie-based authentication credentials.
The provided text describes multiple input-validation vulnerabilities in OpenBiblio, including SQL injection, XSS, HTML injection, and local file inclusion. It references a specific XSS example but does not include functional exploit code.
The provided text describes multiple input-validation vulnerabilities in OpenBiblio, including SQL injection, XSS, HTML injection, and local file inclusion. It includes an example URL demonstrating XSS but lacks executable exploit code.