Exploitation Summary
EIP tracks 5 public exploits for CVE-2008-0980. PoCs published by Richard Brain.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Spyce 2.1.3 by injecting a malicious script into the 'name' parameter of a request. The PoC shows how an attacker can execute arbitrary JavaScript in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Spyce - Python Server Pages (PSP) 2.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) the url or type parameter to docs/examples/redirect.spy; (2) the x parameter to docs/examples/handlervalidate.spy; (3) the name parameter to spyce/examples/request.spy; (4) the Name parameter to spyce/examples/getpost.spy; (5) the mytextarea parameter, the mypass parameter, or an empty parameter to spyce/examples/formtag.spy; (6) the newline parameter to the default URI under demos/chat/; (7) the text1 parameter to docs/examples/formintro.spy; or (8) the mytext or mydate parameter to docs/examples/formtag.spy.
Exploits (5)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Spyce 2.1.3 by injecting a malicious script into the 'name' parameter of a request. The PoC shows how an attacker can execute arbitrary JavaScript in the context of the affected site.
This exploit demonstrates a reflected XSS vulnerability in Spyce 2.1.3 by injecting arbitrary JavaScript code via the 'Name' parameter in a GET request. The payload triggers a client-side script execution, potentially leading to session hijacking or information disclosure.
This exploit demonstrates a reflected XSS vulnerability in Spyce 2.1.3 by injecting a malicious script via the 'x' parameter in the 'handlervalidate.spy' endpoint. The PoC triggers an alert dialog, proving arbitrary JavaScript execution in the context of the affected site.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Spyce 2.1.3 by injecting malicious scripts via URL parameters. The PoC shows how an attacker can execute arbitrary JavaScript in the context of the affected site, potentially stealing cookies or disclosing server paths.
This is a writeup describing a cross-site scripting (XSS) vulnerability in Spyce 2.1.3. The vulnerability allows arbitrary script execution in the context of the affected site, potentially leading to credential theft or other client-side attacks.