CVE-2008-1225

WebCT Campus Edition 4.1.5.8 - Authenticated Cross-Site Scripting via Mail or Discussion Board Message

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-1225. PoCs published by Lupton.

AI-analyzed exploit summary This exploit demonstrates an HTML injection vulnerability in WebCT 4.1.5.8, allowing attackers to steal session cookies via JavaScript injection in mail or discussion board messages. The PoC includes two attacks: one for IE6SP2 (automatic) and another for Firefox (manual).

Description

Multiple cross-site scripting (XSS) vulnerabilities in WebCT Campus Edition 4.1.5.8, when "Don't wrap text" is enabled, allow remote authenticated users to inject arbitrary web script or HTML via a (1) mail message or (2) discussion board message. NOTE: this might overlap CVE-2005-1076.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Lupton · textwebappsphp
https://www.exploit-db.com/exploits/31337

This exploit demonstrates an HTML injection vulnerability in WebCT 4.1.5.8, allowing attackers to steal session cookies via JavaScript injection in mail or discussion board messages. The PoC includes two attacks: one for IE6SP2 (automatic) and another for Firefox (manual).

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: WebCT Campus Edition 4.1.5.8
Auth required
Prerequisites: Access to post messages in WebCT's mail or discussion board · Victim must view the malicious message
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/28107
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29227
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/41047
Exploit mailing-list x_refsource_fulldisc
http://marc.info/?l=full-disclosure&m=120471944119467&w=2
Various Sources x_refsource_misc
http://www.balupton.com/documents/webct_exploits.txt

Scores

EPSS 0.0051
EPSS Percentile 66.8%

Details

CWE
CWE-79
Status published
Products (1)
webct/webct 4.1.5.8
Published Mar 10, 2008
Tracked Since Feb 18, 2026