CVE-2008-1061
NUCLEISniplets Plugin 1.1.2 and 1.2.2 for WordPress - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-1061. PoCs published by NBBN. A Nuclei detection template is also available.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in WordPress Plugin Sniplets 1.1.2, including Remote File Inclusion (RFI), Cross-Site Scripting (XSS), and Remote Code Execution (RCE). The RFI and RCE vulnerabilities require 'Register Globals' to be enabled, while XSS can occur with or without it.
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to (a) warning.php, (b) notice.php, and (c) inset.php in view/sniplets/, and possibly (d) modules/execute.php; the (2) url parameter to (e) view/admin/submenu.php; and the (3) page parameter to (f) view/admin/pager.php.
Exploits (1)
The exploit demonstrates multiple vulnerabilities in WordPress Plugin Sniplets 1.1.2, including Remote File Inclusion (RFI), Cross-Site Scripting (XSS), and Remote Code Execution (RCE). The RFI and RCE vulnerabilities require 'Register Globals' to be enabled, while XSS can occur with or without it.